CVE-2011-4858: Apache Tomcat predictable hash collision denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw is remotely triggerable without authentication and exploit code exists, but it only causes partial availability loss and patches have been available since 2011-2012.

What it is

Apache Tomcat before 5.5.35, 6.0.35 and 7.0.23 computes hash values for form parameters without limiting the ability to predictably trigger hash collisions. A remote attacker can send many crafted parameters to force excessive hash collision handling and consume CPU. The flaw matters because it lets an unauthenticated client degrade or exhaust request-processing capacity on exposed Tomcat instances.

Impact

An attacker can cause a denial of service through sustained CPU consumption, slowing or stalling request handling for legitimate users. There is no confidentiality or integrity impact; the CVSS vector rates availability impact as partial.

Attack surface

Reachable over the network via HTTP requests carrying crafted form parameters, per the AV:N/AC:L/Au:N vector. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at 0.797 (99.6th percentile), and a public proof-of-concept hash collision tool is referenced, indicating exploit code is available.

What to do

• Upgrade Tomcat to 5.5.35, 6.0.35, 7.0.23 or later, or apply the vendor and distribution patches referenced in the Red Hat, Debian and Apache advisories.
• If immediate upgrade is not possible, limit the number of request parameters accepted and cap request body size at the reverse proxy or connector level.
• Restrict direct internet exposure of Tomcat and place it behind a proxy that enforces request rate and size limits.
• Monitor CPU and request latency on Tomcat hosts so collision floods are detected and throttled early.

Detection

• Alert on sustained CPU saturation on Tomcat hosts correlated with high volumes of POST requests containing unusually large numbers of parameters.
• Baseline normal parameter counts per endpoint and flag requests that greatly exceed the baseline.
• Use proxy or WAF logs to identify single sources sending repeated parameter-heavy requests in a short window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.