Description
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze5 | DSA-2399-1 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny14 | DSA-2399-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-3.el6_2.5 | RHSA-2012:0019 |
| RHEL 5 | php +18 | 5.1.6-27.el5_7.4 | RHSA-2012:0033 |
| RHEL 5 | php53 +20 | 5.3.3-1.el5_7.5 | RHSA-2012:0019 |
| RHEL 4 | php +13 | 4.3.9-3.35 | RHSA-2012:0071 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Hashtable Collisions
auxiliary/dos/http/hashcollision_dos
Exploit-DB 3
- PHP Hash Table Collision - Denial of Service (PoC) EDB-18305 · dos · Jan 3, 2012 · verified
- PHP 5.3.8 - Hashtables Denial of Service EDB-18296 · dos · Jan 1, 2012
- MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection EDB-2012 · webapps · Jul 15, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2012:0019 Red Hat Security Advisory: php53 and php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0071 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0033 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2399-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
- HPSBMU02786 vendor-advisory
- 1026473 vdb-entry
- 47404 third-party-advisory
- HPSBOV02763 vendor-advisory
- http://www.nruns.com/_downloads/advisory28122011.pdf
- php-hash-dos(72021) vdb-entry
- 18296 exploit
- DSA-2399 vendor-advisory
- SUSE-SU-2012:0411 vendor-advisory
- MDVSA-2011:197 vendor-advisory
- 18305 exploit
- openSUSE-SU-2012:0426 vendor-advisory
- 48668 third-party-advisory
- RHSA-2012:0019 vendor-advisory
- 51193 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- VU#903934 third-party-advisory
- http://svn.php.net/viewvc?view=revision&revision=321003
- http://svn.php.net/viewvc?view=revision&revision=321040
- RHSA-2012:0071 vendor-advisory
- SSRT100728 vendor-advisory
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table mailing-list
- http://support.apple.com/kb/HT5281
- MDVSA-2013:150 vendor-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- http://www.ocert.org/advisories/ocert-2011-003.html