OliveTin’s OAuth2 login handler stores per‑session state in a map that never purges entries. When an unauthenticated attacker repeatedly requests the /oauth/login endpoint, the map grows without bound, eventually exhausting system memory and causing the web service to become unresponsive. The flaw is a classic memory consumption weakness that leads to a denial of service but does not allow code execution or privilege escalation.

OliveTin versions from 3000.0.0 up to and including 3000.17.0 are affected. The fix is applied in the 3000.17.0 release, so any deployment running that version or later is not vulnerable. Versions prior to 3000.0.0 or any version beyond 3000.17.0 are outside the stated vulnerable range.

The CVSS score of 7.5 indicates a high severity denial of service vulnerability. The EPSS score of less than 1% suggests a very low probability of current exploitation, and there is no listing in the CISA KEV catalog. The attack can be carried out by sending unauthenticated HTTP requests to the /oauth/login endpoint from any entity with network access to the OliveTin instance, without the need for authentication or privileged credentials.