Denial of Service Vulnerability in Apache Geronimo by Predictable Hash Collisions

CVE-2011-5034

Summary

Apache Geronimo versions 2.2.1 and earlier are prone to a denial of service vulnerability that arises from the way the software computes hash values for form parameters. The flaw allows remote attackers to send crafted parameters that trigger predictable hash collisions. This can lead to excessive CPU consumption as the application struggles to process the malicious input, effectively denying service to legitimate users. The vulnerability, which may overlap with other identified issues, highlights the importance of implementing robust input handling to mitigate such attacks.

References