CVE-2011-4461

jetty: hash table collisions CPU usage DoS (oCERT-2011-003)

Published Dec 30, 2011 CVSS 3.0 · 5.3 Medium EPSS 4.9% KEV · Not listed
Description
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-5062 Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Github GHSA Github GHSA GHSA-qxp4-27vx-xmm3 Improper Input Validation in Jetty
Ubuntu USN Ubuntu USN USN-1429-1 Jetty vulnerability
History
Type Values Removed Values Added
Metrics epss

{'score': 0.03003}

epss

{'score': 0.04503}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 12:09 AM
Reserved
Nov 17, 2011, 12:00 AM
Status
Modified
Published
Dec 30, 2011, 1:55 AM
Modified
Jun 16, 2026, 11:34 PM
Severity
Low
Public date
Dec 28, 2011, 12:00 AM