CVE-2011-5035 Denial of service in n/a

Medium 5.0 Published 30 Dec 2011 Updated 7 Aug 2024

Remote attackers can cause denial of service via CPU exhaustion by sending crafted form parameters that trigger hash collisions in Oracle Glassfish.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-5035?

CVE-2011-5035 is a medium-severity denial of service vulnerability in n/a, published on 30 Dec 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.

Weakness: CWE-20

Which versions are affected by CVE-2011-5035?

It affects 1 product.

Products include Oracle Glassfish Server.

How do I fix CVE-2011-5035?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-5035 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-5035 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Sources

Also known as GHSA-6mxv-54wx-wppj.