← Vulnerability feed

Vulnerability record · CVE-2011-5036 · published 30 December 2011

CVE-2011-5036: Rack project rack vulnerability

Rack Project · Rack

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

5.0 CVSS 2.0 Medium EPSS 3.9% · top 10.1% CWE-310 · CWE-310
5.0CVSS 2.0 base score
3.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
http://www.debian.org/security/2013/dsa-2783
http://www.kb.cert.org/vuls/id/903934 US Government Resource
http://www.nruns.com/_downloads/advisory28122011.pdf
http://www.ocert.org/advisories/ocert-2011-003.html
https://gist.github.com/52bbc6b9cc19ce330829 Exploit
http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
http://www.debian.org/security/2013/dsa-2783
http://www.kb.cert.org/vuls/id/903934 US Government Resource
http://www.nruns.com/_downloads/advisory28122011.pdf
http://www.ocert.org/advisories/ocert-2011-003.html
https://gist.github.com/52bbc6b9cc19ce330829 Exploit

Track CVE-2011-5036 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-30123Rack project rack vulnerabilityA sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and Common…EPSS 1.9%8.6CVE-2020-8161Rack project rack path traversal vulnerabilityA directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory a…EPSS 3.4%7.5CVE-2022-30122Rack project rack uncontrolled resource consumption vulnerabilityA possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.EPSS 2.2%7.5CVE-2020-8184Rack project rack improper input validation vulnerabilityA reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an…EPSS 2.9%7.5CVE-2018-16470Rack project rack uncontrolled resource consumption vulnerabilityThere is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to ente…EPSS 2.0%6.1CVE-2018-16471Rack project rack cross-site scripting vulnerabilityThere is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method…EPSS 1.9%5.1CVE-2013-0263Rack project rack vulnerabilityRack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote a…EPSS 5.4%5.0CVE-2015-3225Rack project rack vulnerabilitylib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to …EPSS 8.0%

Source: NIST National Vulnerability Database (record CVE-2011-5036), CISA KEV, FIRST EPSS (scores of 2026-09-30). This page is refreshed as NVD updates the record.