Unscored severity · published Dec 30, 2011
CVE-2011-5036
Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably,…
–
CVSS
3.9%
EPSS
No
On KEV
Description
Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rack · Rack Project
through 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-5036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-5036
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
www.debian.org
http://www.debian.org/security/2013/dsa-2783
US Government Resource
http://www.kb.cert.org/vuls/id/903934
www.nruns.com
http://www.nruns.com/_downloads/advisory28122011.pdf
www.ocert.org
http://www.ocert.org/advisories/ocert-2011-003.html
Exploit
https://gist.github.com/52bbc6b9cc19ce330829
More from Rack
10.0
CVE-2022-30123
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack
8.6
CVE-2020-8161
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack…
7.5
CVE-2022-30122
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack
7.5
CVE-2020-8184
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or…
7.5
CVE-2018-16470
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6