{"id":"CVE-2011-4858","published":"2012-01-05T19:00:00Z","modified":"2024-08-07T00:16:35Z","title":"Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in Apache Tomcat's handling of form parameters, which are hashed without restriction on predictable hash collisions in the affected 5.5.x, 6.x, and 7.x releases before the fixed versions. An attacker with network access can send requests containing many crafted parameters, requiring no authentication or user interaction, to consume CPU and cause a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:51Z"},"cvss":null,"epss":{"score":0.79713,"percentile":0.99605,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py","tags":["x_refsource_MISC"]},{"url":"http://www.debian.org/security/2012/dsa-2401","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.nruns.com/_downloads/advisory28122011.pdf","tags":["x_refsource_MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0325.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0078.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/51200","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=750521","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/48791","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://tomcat.apache.org/tomcat-7.0-doc/changelog.html","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0075.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0074.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/48549","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0089.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/54971","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/48790","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/55115","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.kb.cert.org/vuls/id/903934","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://marc.info/?l=bugtraq&m=133294394108746&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=132871655717248&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0406.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0076.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0077.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.ocert.org/advisories/ocert-2011-003.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=5.5.0, <5.5.35",">=6.0.0, <6.0.35",">=7.0.0, <7.0.23"],"patched":["5.5.35","6.0.35","7.0.23"],"from":["GHSA-wr3m-gw98-mc3j"],"provenance":"source"}],"advisories":[{"id":"GHSA-wr3m-gw98-mc3j","url":"https://github.com/advisories/GHSA-wr3m-gw98-mc3j","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=5.5.0, <5.5.35"],"patched":["5.5.35"],"provenance":"source","from":"GHSA"},{"id":"GHSA-wr3m-gw98-mc3j","url":"https://github.com/advisories/GHSA-wr3m-gw98-mc3j","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=6.0.0, <6.0.35"],"patched":["6.0.35"],"provenance":"source","from":"GHSA"},{"id":"GHSA-wr3m-gw98-mc3j","url":"https://github.com/advisories/GHSA-wr3m-gw98-mc3j","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.0, <7.0.23"],"patched":["7.0.23"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5625","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5625","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":2012,"url":"https://www.exploit-db.com/exploits/2012","title":"MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection","type":"webapps","platform":"php","date":"2006-07-15","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2006-07-15"},"metasploit":[{"name":"Hashtable Collisions","module":"auxiliary/dos/http/hashcollision_dos","type":"auxiliary","disclosureDate":"2011-12-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb"}],"first":{"date":"2006-07-15","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/2012"},"provenance":"source"},"exploitRefs":["https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py"],"flow":[],"timeline":[{"date":"2006-07-15","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-2012); later: Metasploit 2011-12-28","url":"https://www.exploit-db.com/exploits/2012","provenance":"source"},{"date":"2012-01-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2011-4858","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9960"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2011-2526","published":"2011-07-14","fixed":"7.0.19","kev":false},{"cve":"CVE-2011-3190","published":"2011-08-31","fixed":"7.0.21","kev":false,"link":{"from":"CVE-2011-3190","to":"CVE-2011-4858","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.34","toFixed":"6.0.35","daysApart":127}]}},{"cve":"CVE-2011-3375","published":"2012-01-19","fixed":"7.0.22","kev":false},{"cve":"CVE-2011-4858","published":"2012-01-05","fixed":"7.0.23","kev":false},{"cve":"CVE-2012-0022","published":"2012-01-19","fixed":"7.0.23","kev":false},{"cve":"CVE-2012-3544","published":"2013-06-01","fixed":"7.0.30","kev":false},{"cve":"CVE-2012-3546","published":"2012-12-19","fixed":"7.0.30","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}