CVE-2011-5035: Oracle GlassFish predictable hash collisions allow denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with a public proof-of-concept and very high EPSS score, though impact is availability-only and no KEV listing exists.

What it is

Oracle GlassFish computes hash values for form parameters without limiting predictable hash collisions, so a remote attacker can force excessive CPU use. The flaw affects GlassFish 2.1.1, 3.0.1 and 3.1.1 as used in Communications Server 2.0 and Sun Java System Application Server 8.1/8.2, and possibly other products. It matters because a single unauthenticated request stream can exhaust server CPU and deny service.

Impact

An attacker can consume server CPU and degrade or deny availability of the affected application server. No data confidentiality or integrity impact is described; the effect is availability only.

Attack surface

Reachable over the network via HTTP form parameters; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any endpoint that parses form parameters is a candidate.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.67932 (99.3rd percentile), indicating high predicted exploitation activity. A public proof-of-concept is referenced (HashCollision-DOS-POC), so exploitation is feasible.

What to do

• Apply the Oracle CPU patches referenced in the Oracle advisories (cpujan2012, cpuapr2012, cpujan2013) or the relevant vendor errata for your distribution.
• Upgrade to a GlassFish release that randomizes or limits hash collision behavior, or migrate off the affected 2.1.1/3.0.1/3.1.1 versions.
• Limit the number of form parameters and request body size accepted by the front-end proxy or web container.
• Rate-limit or throttle requests per source IP at the reverse proxy to blunt parameter-flooding attempts.
• Monitor CPU saturation on GlassFish hosts and isolate or restart instances under sustained parameter-flood load.

Detection

• Alert on sustained high CPU on GlassFish hosts correlated with a spike in POST requests carrying unusually large numbers of form parameters.
• Inspect HTTP access logs for requests with abnormally long parameter strings or thousands of parameters from a single source.
• Track request rate per client IP and flag sources sending parameter-heavy requests far above baseline.
• Use the referenced OVAL definition to check installed GlassFish versions against the vulnerable set.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.