CVE-2012-5370
jruby jruby: no CVSS score yet. EPSS 2.2% chance of exploitation in the next 30 days. Fixed in org.jruby:jruby-parent 1.7.1.
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jruby:jruby
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fmmq-j7pq-f85c | Maven | org.jruby:jruby-parent | <1.7.1 | 1.7.1 |
References
- http://2012.appsec-forum.ch/conferences/#c17
- http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf
- http://rhn.redhat.com/errata/RHSA-2013-0533.html
- http://www.ocert.org/advisories/ocert-2012-001.html
- https://bugzilla.redhat.com/show_bug.cgi?id=880671