CVE-2011-3414
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP...
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
- Record
CVE-2011-3414- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
- Record
CVE-2011-3414- Updated
- 2026-11-02
EUVDEUVD-2011-3377 No score
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
- Record
EUVD-2011-3377- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-95wq-73j6-rm8c No score
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP...
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
- Record
GHSA-95wq-73j6-rm8c- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3414 is a high vulnerability (CVSS 7.8) in Microsoft Windows 7, published December 30, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 57.7%, the 99th percentile. No source names a fixed version.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14588
nruns.com/_downloads/advisory28122011.pdf
us-cert.gov/cas/techalerts/TA11-347A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
kb.cert.org/vuls/id/903934
archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
ocert.org/advisories/ocert-2011-003.html
nvd.nist.gov/vuln/detail/CVE-2011-3414
github.com/advisories/GHSA-95wq-73j6-rm8c