CVE-2012-5372
Rubinius computes hash values without properly restricting the ability to trigger hash collisions...
CVE-2012-5372 is a medium vulnerability (CVSS 5.0) in Rubinius, published November 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. No source names a fixed version.
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
Exploit likelihood
What each source reports
NVD Score used
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
CVE-2012-5372- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
CVE-2012-5372- Updated
- 2026-11-02
EUVDEUVD-2012-5291 No score
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
EUVD-2012-5291- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9f35-5wj4-v27g No score
Rubinius computes hash values without properly restricting the ability to trigger hash collisions...
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
GHSA-9f35-5wj4-v27g- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf
131002.net/data/talks/appsec12_slides.pdf
2012.appsec-forum.ch/conferences
ocert.org/advisories/ocert-2012-001.html
securityfocus.com/bid/56670
nvd.nist.gov/vuln/detail/CVE-2012-5372
github.com/advisories/GHSA-9f35-5wj4-v27g