CVE-2011-5034
Apache Geronimo Hash Collisions Cause DoS
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Exploit likelihood
What each source reports
NVD Score used
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
- Record
CVE-2011-5034- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
- Record
CVE-2011-5034- Updated
- 2026-11-02
EUVDEUVD-2022-5271 No score
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
- Record
EUVD-2022-5271- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3h8-rw48-h4gr No score
Apache Geronimo Hash Collisions Cause DoS
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
- Record
GHSA-v3h8-rw48-h4gr- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-v3h8-rw48-h4gr No score
Apache Geronimo Hash Collisions Cause DoS
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
- Record
GHSA-v3h8-rw48-h4gr- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.geronimo:geronimoMaven |
before 2.2.1 | 2.2.1 |
org.apache.geronimo:geronimoMaven |
before 2.2.1, plus listed versions 1.2-beta2.0.12.0.22.12.1.1 Show 8 moreShow less2.1.22.1.32.1.42.1.52.1.62.1.72.1.82.2 |
2.2.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection | 2006-07-15 |
| Metasploit | Hashtable Collisions | 2011-12-28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-5034 is a high vulnerability (CVSS 7.8) in Apache Geronimo, published December 30, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 80.6%, the 99th percentile. Fixed in org.apache.geronimo:geronimo 2.2.1.
References
github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
nruns.com/_downloads/advisory28122011.pdf
secunia.com/advisories/47412
kb.cert.org/vuls/id/903934
archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
ocert.org/advisories/ocert-2011-003.html
Show 27 moreShow less
lists.apache.org/thread.html/r8dc1a0ae0e0cf9d2494b8cbd66562f99331c4cf635e7781850a9b9ba%40%3Cjava-dev.axis.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-5034
web.archive.org/web/20120105151644/http://www.nruns.com/_downloads/advisory28122011.pdf