CVE-2011-5035
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System...
5.0 MediumPublic exploitFix available
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Exploit likelihood
68.2%Up 63.8 points since Feb 4, 2022
What each source reports
NVD Score used
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
- Record
CVE-2011-5035- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
- Record
CVE-2011-5035- Updated
- 2026-11-02
EUVDEUVD-2011-4939 No score
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
- Record
EUVD-2011-4939- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mxv-54wx-wppj No score
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System...
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
- Record
GHSA-6mxv-54wx-wppj- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10534-1 No score
java-1_7_0-openjdk-1.7.0.121-1.1 on GA media
These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10534-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-6Debian:6.0 |
before 6b18-1.8.13-0+squeeze1, plus listed versions 6b18-1.8.10-0+squeeze16b18-1.8.10-0+squeeze26b18-1.8.10-0~lenny16b18-1.8.10-0~lenny26b18-1.8.3-2 Show 12 moreShow less6b18-1.8.3-2+squeeze16b18-1.8.4-16b18-1.8.5-16b18-1.8.7-16b18-1.8.7-26b18-1.8.7-2~lenny16b18-1.8.7-2~squeeze16b18-1.8.7-36b18-1.8.7-46b18-1.8.7-56b18-1.8.9-0.16b18-1.8.9-0.1~squeeze1 |
6b18-1.8.13-0+squeeze1 |
java-1.6.0-openjdkRed Hat:enterprise_linux:6::client |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:6::client |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:6::client |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:6::client |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:6::client |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:6::client |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:6::computenode |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:6::computenode |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:6::computenode |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
Show 79 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-openjdk-develRed Hat:enterprise_linux:6::computenode |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:6::computenode |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:6::computenode |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:6::server |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:6::server |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:6::server |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:6::server |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:6::server |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:6::server |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:6::workstation |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:6::workstation |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:6::workstation |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:6::workstation |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:6::workstation |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:6::workstation |
before 1:1.6.0.0-1.43.1.10.6.el6_2 | 1:1.6.0.0-1.43.1.10.6.el6_2 |
java-1.6.0-sunRed Hat:rhel_extras:4 |
before 1:1.6.0.31-1jpp.1.el4 | 1:1.6.0.31-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.31-1jpp.1.el4 | 1:1.6.0.31-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 |
before 1:1.6.0.31-1jpp.1.el4 | 1:1.6.0.31-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.31-1jpp.1.el4 | 1:1.6.0.31-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.31-1jpp.1.el4 | 1:1.6.0.31-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.31-1jpp.1.el4 | 1:1.6.0.31-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.31-1jpp.1.el5 | 1:1.6.0.31-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:6 |
before 1:1.6.0.31-1jpp.1.el6_2 | 1:1.6.0.31-1jpp.1.el6_2 |
java-1.6.0-sun-demoRed Hat:rhel_extras:6 |
before 1:1.6.0.31-1jpp.1.el6_2 | 1:1.6.0.31-1jpp.1.el6_2 |
java-1.6.0-sun-develRed Hat:rhel_extras:6 |
before 1:1.6.0.31-1jpp.1.el6_2 | 1:1.6.0.31-1jpp.1.el6_2 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:6 |
before 1:1.6.0.31-1jpp.1.el6_2 | 1:1.6.0.31-1jpp.1.el6_2 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:6 |
before 1:1.6.0.31-1jpp.1.el6_2 | 1:1.6.0.31-1jpp.1.el6_2 |
java-1.6.0-sun-srcRed Hat:rhel_extras:6 |
before 1:1.6.0.31-1jpp.1.el6_2 | 1:1.6.0.31-1jpp.1.el6_2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-1.25.1.10.6.el5_8 | 1:1.6.0.0-1.25.1.10.6.el5_8 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.10.1-1jpp.1.el5 | 1:1.6.0.10.1-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibm-develRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.6.0.10.1-1jpp.5.el6_2 | 1:1.6.0.10.1-1jpp.5.el6_2 |
java-1.6.0-ibmRed Hat:network_satellite:5.4::el5 |
before 1:1.6.0.14.0-1jpp.1.el5_9 | 1:1.6.0.14.0-1jpp.1.el5_9 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.4::el5 |
before 1:1.6.0.14.0-1jpp.1.el5_9 | 1:1.6.0.14.0-1jpp.1.el5_9 |
java-1.6.0-ibmRed Hat:network_satellite:5.4::el6 |
before 1:1.6.0.14.0-1jpp.1.el6_4 | 1:1.6.0.14.0-1jpp.1.el6_4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.4::el6 |
before 1:1.6.0.14.0-1jpp.1.el6_4 | 1:1.6.0.14.0-1jpp.1.el6_4 |
java-1_7_0-openjdkopenSUSE:Tumbleweed |
before 1.7.0.121-1.1 | 1.7.0.121-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection | 2006-07-15 |
| Metasploit | Hashtable Collisions | 2011-12-28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-5035 is a medium vulnerability (CVSS 5.0) in Oracle Glassfish Server, published December 30, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 68.2%, the 99th percentile. Fixed in openjdk-6 6b18-1.8.13-0+squeeze1.
References
secunia.com/advisories/48074
marc.info?l=bugtraq&m=133847939902305&w=2
github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
security.gentoo.org/glsa/glsa-201406-32.xml
Show 194 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16908
nruns.com/_downloads/advisory28122011.pdf
rhn.redhat.com/errata/RHSA-2013-1455.html
oracle.com/technetwork/topics/security/cpujan2013-1515902.html
lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.html
kb.cert.org/vuls/id/903934
debian.org/security/2012/dsa-2420
archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
mandriva.com/security/advisories?name=MDVSA-2013:150
ocert.org/advisories/ocert-2011-003.html
nvd.nist.gov/vuln/detail/CVE-2011-5035
access.redhat.com/errata/RHSA-2012:0135
icedtea.classpath.org/hg/release/icedtea6-1.10/file/icedtea6-1.10.6/NEWS
bugzilla.redhat.com/show_bug.cgi?id=788606
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0135.json
cve.org/CVERecord?id=CVE-2011-3563
cisa.gov/known-exploited-vulnerabilities-catalog
ibm.com/developerworks/java/jdk/alerts
xforce.iss.net/xforce/xfdb/78764
isg.rhul.ac.uk/tls
openssl.org/news/secadv_20130205.txt
polarssl.org/tech-updates/releases/polarssl-1.2.5-released
suse.com/security/cve/CVE-2011-3563
This page doesn't list everything
Left out here: 796 references. The JSON record has them.