CVE-2011-5034
N/A
Published: December 30, 2011 at 01:00 AM UTC
Updated: June 16, 2026 at 11:35 PM UTC
1 product affected across 1 vendorGeronimo
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 81%
Description
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (17)
Mailing Listx_refsource_BUGTRAQ
Source: [email protected]
http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.htmlThird Party Advisoryx_refsource_CERT-VNUS Government Resource
Source: [email protected]
http://www.kb.cert.org/vuls/id/903934x_refsource_MISC
Source: [email protected]
https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.pyMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r20957aa5962a48328f199e2373f408aeeae601a45dd5275a195e2b6e%40%3Cjava-dev.axis.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r360b70489bad65286b49ceb5303a849d2a7ec7d1292774a7259579e1%40%3Cissues.karaf.apache.org%3EQuick Info
StatusMODIFIED
CWE
CWE-20
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card