CVE-2012-0039
** DISPUTED ** GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash...
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
Exploit likelihood
What each source reports
CVE List
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
CVE-2012-0039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2012-0079
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
EUVD-2012-0079- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7w5v-h2pc-qqwc
** DISPUTED ** GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash...
** DISPUTED ** GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
GHSA-7w5v-h2pc-qqwc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
CVE-2012-0039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
OSVBELL-CVE-2012-0039
CVE-2012-0039 does not affect BellSoft software
- Record
BELL-CVE-2012-0039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0039
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
DEBIAN-CVE-2012-0039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-0039
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
UBUNTU-CVE-2012-0039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
- Record
CVE-2012-0039- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib2.0Debian:12 |
All versions, plus listed versions 2.74.6-22.74.6-2+deb12u12.74.6-2+deb12u22.74.6-2+deb12u32.74.6-2+deb12u4 Show 45 moreShow less2.74.6-2+deb12u52.74.6-2+deb12u62.74.6-2+deb12u72.74.6-2+deb12u82.74.6-2+deb12u92.75.0-12.75.2-12.75.3-12.75.3-22.75.3-32.75.4-12.76.0-12.76.1-12.76.2-12.76.3-12.76.4-12.76.4-22.76.4-32.76.4-42.77.0-12.77.1-12.77.1-22.77.2-12.77.3-12.78.0-12.78.0-22.78.1-12.78.1-22.78.1-32.78.1-42.78.2-12.78.3-12.78.3-22.78.4-12.78.4-22.78.4-2.12.78.4-32.78.4-42.78.4-52.78.4-62.78.4-72.79.0+git20240110~g38f5ba3c-12.79.0+git20240110~g38f5ba3c-22.79.0+git20240119~62ee8bf6-12.79.1-1 |
None known |
glib2.0Debian:13 |
All versions, plus listed versions 2.84.3-12.84.4-12.84.4-22.84.4-32.84.4-3~deb13u1 Show 45 moreShow less2.84.4-3~deb13u22.84.4-3~deb13u32.84.4-3~deb13u42.84.4-3~deb13u52.85.1-12.85.1-22.85.2-22.85.3-12.85.4-12.86.0-12.86.0-22.86.0-32.86.0-42.86.0-52.86.0-62.86.0-72.86.1-12.86.1-22.86.2-12.86.3-12.86.3-22.86.3-32.86.3-42.86.3-52.87.1-12.87.2-12.87.2-22.87.2-32.87.3-12.87.3~gitlab0-12.87.5-12.88.0-12.88.1-22.88.2-12.88.3-12.88.3-22.88.3-32.89.2-12.89.3-12.89.3-22.89.3-32.89.3-42.89.3-52.89.4-22.90.0-1 |
None known |
glib2.0Debian:14 |
All versions, plus listed versions 2.84.3-12.84.4-12.84.4-22.84.4-32.84.4-3~deb13u1 Show 45 moreShow less2.84.4-3~deb13u22.84.4-3~deb13u32.84.4-3~deb13u42.84.4-3~deb13u52.85.1-12.85.1-22.85.2-22.85.3-12.85.4-12.86.0-12.86.0-22.86.0-32.86.0-42.86.0-52.86.0-62.86.0-72.86.1-12.86.1-22.86.2-12.86.3-12.86.3-22.86.3-32.86.3-42.86.3-52.87.1-12.87.2-12.87.2-22.87.2-32.87.3-12.87.3~gitlab0-12.87.5-12.88.0-12.88.1-22.88.2-12.88.3-12.88.3-22.88.3-32.89.2-12.89.3-12.89.3-22.89.3-32.89.3-42.89.3-52.89.4-22.90.0-1 |
None known |
glib2.0Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.38.0-1ubuntu12.38.1-12.39.1-0ubuntu12.39.1-0ubuntu22.39.1-0ubuntu3 Show 20 moreShow less2.39.2-0ubuntu12.39.2-0ubuntu22.39.3-0ubuntu42.39.4-0ubuntu12.39.90-0ubuntu12.39.91-0ubuntu22.39.91-0ubuntu32.39.92-22.40.0-12.40.0-1ubuntu12.40.0-22.40.2-0ubuntu12.40.2-0ubuntu1.12.40.2-0ubuntu1.1+esm12.40.2-0ubuntu1.1+esm22.40.2-0ubuntu1.1+esm32.40.2-0ubuntu1.1+esm42.40.2-0ubuntu1.1+esm62.40.2-0ubuntu1.1+esm72.40.2-0ubuntu1.1+esm8 |
None known |
glib2.0Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.46.1-12.46.1-22.47.1-12.47.3-32.47.4-1 Show 21 moreShow less2.47.5-12.47.6-12.48.0-1ubuntu32.48.0-1ubuntu42.48.1-1~ubuntu16.04.12.48.2-0ubuntu12.48.2-0ubuntu32.48.2-0ubuntu42.48.2-0ubuntu4.12.48.2-0ubuntu4.22.48.2-0ubuntu4.32.48.2-0ubuntu4.42.48.2-0ubuntu4.52.48.2-0ubuntu4.62.48.2-0ubuntu4.72.48.2-0ubuntu4.82.48.2-0ubuntu4.8+esm12.48.2-0ubuntu4.8+esm32.48.2-0ubuntu4.8+esm42.48.2-0ubuntu4.8+esm52.48.2-0ubuntu4.8+esm6 |
None known |
glib2.0Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.54.1-1ubuntu12.55.2-2ubuntu12.56.0-2ubuntu12.56.0-4ubuntu12.56.1-2ubuntu1 Show 15 moreShow less2.56.2-0ubuntu0.18.04.12.56.2-0ubuntu0.18.04.22.56.3-0ubuntu0.18.04.12.56.4-0ubuntu0.18.04.22.56.4-0ubuntu0.18.04.32.56.4-0ubuntu0.18.04.42.56.4-0ubuntu0.18.04.52.56.4-0ubuntu0.18.04.62.56.4-0ubuntu0.18.04.72.56.4-0ubuntu0.18.04.82.56.4-0ubuntu0.18.04.92.56.4-0ubuntu0.18.04.9+esm32.56.4-0ubuntu0.18.04.9+esm42.56.4-0ubuntu0.18.04.9+esm52.56.4-0ubuntu0.18.04.9+esm6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0039 is a medium vulnerability (CVSS 5.0) in Gnome Glib, published January 14, 2012. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile.
References
Left out here: 100 versions. The JSON record has them.