CVE-2012-5372
Rubinius computes hash values without properly restricting the ability to trigger hash collisions...
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
Exploit likelihood
What each source reports
NVD Score used
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
CVE-2012-5372- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
CVE-2012-5372- Updated
- 2026-11-02
EUVDEUVD-2012-5291No score
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
EUVD-2012-5291- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9f35-5wj4-v27gNo score
Rubinius computes hash values without properly restricting the ability to trigger hash collisions...
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
- Record
GHSA-9f35-5wj4-v27g- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-5372 is a medium vulnerability (CVSS 5.0) in Rubinius, published November 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. No source names a fixed version.
References
asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf
131002.net/data/talks/appsec12_slides.pdf
2012.appsec-forum.ch/conferences
ocert.org/advisories/ocert-2012-001.html
securityfocus.com/bid/56670
nvd.nist.gov/vuln/detail/CVE-2012-5372
github.com/advisories/GHSA-9f35-5wj4-v27g