Denial of Service Vulnerability in Rack by Rackspace
CVE-2011-5036

Currently unrated

Key Information:

Vendor

Rack Project

Status
Rack
Vendor
CVE Published:
30 December 2011

What is CVE-2011-5036?

The Rack library prior to versions 1.1.3, 1.2.5, and 1.3.6 contains a vulnerability where hash values for form parameters are computed without adequate restrictions. This oversight allows remote attackers to exploit predictable hash collisions, potentially leading to a denial of service attack by consuming extensive CPU resources through crafted requests. This issue can significantly hamper application performance and availability.

References

http://www.nruns.com/_downloads/advisory28122011.pdf
x_refsource_MISC
https://gist.github.com/52bbc6b9cc19ce330829
x_refsource_CONFIRM
http://www.kb.cert.org/vuls/id/903934
third-party-advisoryx_refsource_CERT-VN

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2011-5036 : Denial of Service Vulnerability in Rack by Rackspace