Vulnerability record · CVE-2011-5034 · published 30 December 2011
CVE-2011-5034: Apache Geronimo predictable hash collision denial of service
Apache · Geronimo
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker can send many crafted parameters that collide in the hash table, driving excessive CPU consumption. The record notes this may overlap CVE-2011-4461.
Description
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityUnauthenticated remote denial of service with complete availability impact, a very high EPSS score, and a public proof-of-concept, though no KEV listing or active exploitation is confirmed.
What it is
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker can send many crafted parameters that collide in the hash table, driving excessive CPU consumption. The record notes this may overlap CVE-2011-4461.
Impact
An unauthenticated remote attacker can exhaust server CPU and cause a denial of service, degrading or halting the affected application. No data confidentiality or integrity impact is described; the CVSS vector rates availability as complete.
Attack surface
Reachable over the network via HTTP form parameter submission to the Geronimo application, per the AV:N vector. No authentication or user interaction is required (Au:N, and the description specifies remote attackers).
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.80569, 99.6th percentile) and a public proof-of-concept hash collision script is referenced, indicating mature, widely available exploitation techniques.
What to do
- Upgrade Apache Geronimo past 2.2.1 to a release that randomizes or restricts hash computation for form parameters.
- If upgrade is not immediately possible, apply vendor or upstream patches addressing hash collision handling and limit the number of accepted form parameters per request.
- Place the Geronimo application behind a reverse proxy or WAF that caps request parameter counts and request body size.
- Rate-limit and monitor inbound requests to the affected endpoints to blunt high-volume collision floods.
Detection
- Monitor CPU saturation on Geronimo hosts correlated with spikes in HTTP requests containing unusually large numbers of form parameters.
- Alert on requests with abnormally high parameter counts or repeated parameter names from single sources.
- Review web server and application logs for POST bodies with many crafted parameters targeting form-handling endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-5034 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-5034), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
