CVE-2013-7040: Python 2.7 before 3.4 only uses the last eight… (CVSS 4.3)

NVD Score used 4.3

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: CVE-2013-7040
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: CVE-2013-7040
Updated: 2026-11-02

EUVDEUVD-2013-6840 No score

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: EUVD-2013-6840
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cjvq-9vmj-3482 No score

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which...

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: GHSA-cjvq-9vmj-3482
Updated: 2026-11-02

OSV No score

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: CVE-2013-7040
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-7040 No score

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: DEBIAN-CVE-2013-7040
Updated: 2026-11-02

OSVPSF-2014-2 No score

Hash function not randomized properly

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: PSF-2014-2
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-7040 No score

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Record: UBUNTU-CVE-2013-7040
Updated: 2026-11-02

Package	Affected	Fixed
`python2.7` Debian:11	All versions, plus listed versions 2.7.18-102.7.18-112.7.18-122.7.18-132.7.18-13.1 Show 5 moreShow less 2.7.18-13.1~exp12.7.18-13.22.7.18-82.7.18-8+deb11u12.7.18-9	None known
`python2.7` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 35 moreShow less 2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.42.7.6-8ubuntu0.52.7.6-8ubuntu0.6+esm22.7.6-8ubuntu0.6+esm32.7.6-8ubuntu0.6+esm52.7.6-8ubuntu0.6+esm62.7.6-8ubuntu0.6+esm72.7.6-8ubuntu0.6+esm82.7.6-8ubuntu0.6+esm92.7.6-8ubuntu0.6+esm102.7.6-8ubuntu0.6+esm112.7.6-8ubuntu0.6+esm122.7.6-8ubuntu0.6+esm132.7.6-8ubuntu0.6+esm142.7.6-8ubuntu0.6+esm152.7.6-8ubuntu0.6+esm162.7.6-8ubuntu0.6+esm172.7.6-8ubuntu0.6+esm182.7.6-8ubuntu0.6+esm202.7.6-8ubuntu0.6+esm212.7.6-8ubuntu0.6+esm222.7.6-8ubuntu0.6+esm242.7.6-8ubuntu0.6+esm252.7.6-8ubuntu0.6+esm262.7.6-8ubuntu0.6+esm282.7.6-8ubuntu0.6+esm292.7.6-8ubuntu0.6+esm30	None known

When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

CVE-2013-7040

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References