Description

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Remediation

References

CVE-2011-4858

Related Vulnerabilities

jQuery Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4969)

Moodle CVE-2011-4291 Vulnerability (CVE-2011-4291)

PHPFusion Multiple SQL Injection Vulnerabilities (CVE-2014-8596)

Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2019-16942)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2003-1581)

Severity

Medium

Classification

CVE-2011-4858

Tags

Missing Update Known Vulnerabilities