CVE-2011-4858
Improper Input Validation in Apache Tomcat
5.0 MediumPublic exploitFix available
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Exploit likelihood
79.7%Up 72.4 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
CVE-2011-4858- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
CVE-2011-4858- Updated
- 2026-11-02
EUVDEUVD-2022-5625 No score
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
EUVD-2022-5625- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wr3m-gw98-mc3j No score
Improper Input Validation in Apache Tomcat
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
GHSA-wr3m-gw98-mc3j- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-wr3m-gw98-mc3j No score
Improper Input Validation in Apache Tomcat
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
GHSA-wr3m-gw98-mc3j- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.35 | 5.5.35 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.35 | 6.0.35 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.23 | 7.0.23 |
tomcat6Debian:6.0 From an advisory covering 10 CVEs |
before 6.0.35-1+squeeze2, plus listed versions 6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2 Show 7 moreShow less6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-1 |
6.0.35-1+squeeze2 |
jbosswebRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-libRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
Show 127 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-libRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-libRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbosswebRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-libRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbosswebRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-libRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.31.el5_8 | 0:5.5.23-0jpp.31.el5_8 |
tomcat6Red Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-javadocRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-libRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-webappsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6Red Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-libRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-libRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-javadocRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-webappsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6Red Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-libRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat6-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-36.el6_2 | 0:6.0.24-36.el6_2 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection | 2006-07-15 |
| Metasploit | Hashtable Collisions | 2011-12-28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4858 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published January 5, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 79.7%, the 99th percentile. Fixed in org.apache.tomcat:tomcat 5.5.35.
References
github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
debian.org/security/2012/dsa-2401
nruns.com/_downloads/advisory28122011.pdf
rhn.redhat.com/errata/RHSA-2012-0325.html
marc.info?l=bugtraq&m=136485229118404&w=2
Show 81 moreShow less
securityfocus.com/bid/51200
bugzilla.redhat.com/show_bug.cgi?id=750521
secunia.com/advisories/48791
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886
tomcat.apache.org/tomcat-7.0-doc/changelog.html
kb.cert.org/vuls/id/903934
mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e
ocert.org/advisories/ocert-2011-003.html
nvd.nist.gov/vuln/detail/CVE-2011-4858
access.redhat.com/errata/RHSA-2012:0074
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0074.json
cve.org/CVERecord?id=CVE-2011-1184
issues.jboss.org/browse/JBPAPP-4873