Description
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjdk-6 | 6b18-1.8.13-0+squeeze1 | DSA-2420-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.10.1-1jpp.5.el6_2 | RHSA-2012:0514 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.43.1.10.6.el6_2 | RHSA-2012:0135 |
| RHEL 6 | java-1.6.0-sun +5 | 1:1.6.0.31-1jpp.1.el6_2 | RHSA-2012:0139 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.10.1-1jpp.1.el5 | RHSA-2012:0514 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.25.1.10.6.el5_8 | RHSA-2012:0322 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.31-1jpp.1.el5 | RHSA-2012:0139 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.31-1jpp.1.el4 | RHSA-2012:0139 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1455 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Hashtable Collisions
auxiliary/dos/http/hashcollision_dos
Exploit-DB 1
- MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection EDB-2012 · webapps · Jul 15, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2013:1455 Red Hat Security Advisory: Red Hat Network Satellite server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0514 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0139 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0322 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0135 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2420-1 openjdk-6 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 48074 third-party-advisory
- HPSBUX02784 vendor-advisory
- https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
- GLSA-201406-32 vendor-advisory
- HPSBMU02799 vendor-advisory
- 48589 third-party-advisory
- oval:org.mitre.oval:def:16908 vdb-entry signature
- http://www.nruns.com/_downloads/advisory28122011.pdf
- RHSA-2013:1455 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- SUSE-SU-2012:0603 vendor-advisory
- 48073 third-party-advisory
- 48950 third-party-advisory
- HPSBUX02757 vendor-advisory
- 57126 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- VU#903934 third-party-advisory
- DSA-2420 vendor-advisory
- SSRT100867 vendor-advisory
- RHSA-2012:0514 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table mailing-list
- MDVSA-2013:150 vendor-advisory
- HPSBST02955 vendor-advisory
- http://www.ocert.org/advisories/ocert-2011-003.html