CVE-2011-4858

N/A Unknown

Published: January 05, 2012 Modified: April 29, 2026

Description

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=132871655717248&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=133294394108746&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=136485229118404&w=2

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0074.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0075.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0076.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0077.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0078.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0089.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0325.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0406.html

Source: cve@mitre.org

http://secunia.com/advisories/48549

Source: cve@mitre.org

http://secunia.com/advisories/48790

Source: cve@mitre.org

http://secunia.com/advisories/48791

Source: cve@mitre.org

http://secunia.com/advisories/54971

Source: cve@mitre.org

http://secunia.com/advisories/55115

Source: cve@mitre.org

http://tomcat.apache.org/tomcat-7.0-doc/changelog.html

Source: cve@mitre.org

http://www.debian.org/security/2012/dsa-2401

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/903934

Source: cve@mitre.org

US Government Resource

http://www.nruns.com/_downloads/advisory28122011.pdf

Source: cve@mitre.org

http://www.ocert.org/advisories/ocert-2011-003.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/51200

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=750521

Source: cve@mitre.org

https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886

Source: cve@mitre.org

http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e