{"id":"CVE-2004-2761","published":"2009-01-05T20:00:00Z","modified":"2026-05-28T18:20:09Z","title":"The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to…","vendor":null,"product":null,"tier":"tail","description":{"text":"The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.10122,"percentile":0.95629,"provenance":"source"},"cwes":[{"id":"CWE-328","name":"Use of Weak Hash"}],"references":[{"url":"http://www.securityfocus.com/bid/33065","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0837.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.phreedom.org/research/rogue-ca/","tags":["x_refsource_MISC"]},{"url":"http://www.kb.cert.org/vuls/id/836068","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://securityreason.com/securityalert/4866","tags":["third-party-advisory","x_refsource_SREASON"]},{"url":"http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/","tags":["x_refsource_MISC"]},{"url":"http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://www.win.tue.nl/hashclash/SoftIntCodeSign/","tags":["x_refsource_MISC"]},{"url":"http://secunia.com/advisories/33826","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/34281","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.microsoft.com/technet/security/advisory/961509.mspx","tags":["x_refsource_MISC"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03814en_us","tags":["x_refsource_CONFIRM"]},{"url":"http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-collisions-problem.aspx","tags":["x_refsource_MISC"]},{"url":"http://www.doxpara.com/research/md5/md5_someday.pdf","tags":["x_refsource_MISC"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","tags":["x_refsource_MISC"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0838.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://blogs.verisign.com/ssl-blog/2008/12/on_md5_vulnerabilities_and_mit.php","tags":["x_refsource_MISC"]},{"url":"http://www.ubuntu.com/usn/usn-740-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://securitytracker.com/id?1024697","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00096.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/499685/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/42181","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.win.tue.nl/hashclash/rogue-ca/","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=648886","tags":["x_refsource_CONFIRM"]}],"priority":{"score":31.0,"factors":[{"name":"EPSS percentile","points":19.13},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.86}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2004-12-07"},"first":{"date":"2004-12-07","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/24807"},"provenance":"source"},"euvd":{"id":"EUVD-2004-2751","exploited":false,"provenance":"source"},"exploits":[{"id":24807,"url":"https://www.exploit-db.com/exploits/24807","title":"MD5 - Message Digest Algorithm Hash Collision","date":"2004-12-07","verified":true,"provenance":"source"}],"lineage":{"familyId":"fam-sylabs-sif-cve-2004-2761","children":[{"from":"CVE-2004-2761","to":"CVE-2022-39237","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-m5m3-46gj-wch8","via":"reference","url":"https://nvd.nist.gov/vuln/detail/cve-2004-2761"}]}]}}