| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/OliveTin/OliveTin | < 0.0.0-20260301235225-f044d90d5525call versions | 0.0.0-20260301235225-f044d90d5525c |
| olivetin | ≤ 3000.10.2 |
An unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled.
The OAuth2 handler stores per-login state in a shared map without synchronization:
These paths are network reachable via publicly registered routes:
- service/internal/httpservers/frontend.go:71 → /oauth/login
- service/internal/httpservers/frontend.go:72 → /oauth/callback
Because Go HTTP handlers run concurrently, high parallel traffic to /oauth/login causes concurrent map access and runtime panic.
Tested on:
curl -i http://127.0.0.1:1337/readyz
curl -i "http://127.0.0.1:1337/oauth/login?provider=github"
Expected: 200 for /readyz, 302 for /oauth/login.
python3 /OliveTin/tools/poc_oauth2_state_map_race_dos.py \
--base-url http://127.0.0.1:1337 \
--provider github \
--workers 80 \
--requests 120000 \
--health-failures 3
docker inspect olivetin-dos --format 'status={{.State.Status}} exit={{.State.ExitCode}}' docker logs olivetin-dos 2>&1 | grep -E "fatal error: concurrent map|concurrent map writes|restapi_auth_oauth2.go"
Observed result:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free