CVE-2012-0785

Hash collision attack vulnerability in Jenkins

7.5 HighFix available

CVE-2012-0785 is a high vulnerability (CVSS 7.5) in Cloudbees Jenkins, published February 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.35%, the 88th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.447.

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.35%Up 2.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2012-0785
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness: CWE-400
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-0785
Updated: 2026-11-02

EUVDEUVD-2022-1797 No score

Record: EUVD-2022-1797
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pchp-c5w8-47gc 7.5

Hash collision attack vulnerability in Jenkins

Record: GHSA-pchp-c5w8-47gc
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-pchp-c5w8-47gc 7.5