Improper Input Validation in Apache Tomcat

published 2012-01-05 14 y ago modified 2026-06-16 4 mo ago also GHSA-wr3m-gw98-mc3j , EUVD-2022-5625

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 79.7%; EPSS 79.7% chance of exploitation in 30 days, percentile 99.6%
public exploits: 2; Metasploit, Exploit-DB

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Patch / fix

fixed in 1 distros 1

maven org.apache.tomcat:tomcat 5.5.35, 6.0.35, 7.0.23

tomcat6 jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
tomcat6 jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
tomcat6-lib jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
tomcat6-lib jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
tomcat6-log4j jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
tomcat6-log4j jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
tomcat6-javadoc jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
tomcat6-javadoc jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6

red hat advisories RHSA-2012:0682 RHSA-2012:0076 RHSA-2012:0074 RHSA-2012:0680 RHSA-2012:0475 RHSA-2012:0474

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-4858 updated 2026-08-04 cvss 5.0

tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)

Red Hat JBoss Communications Platform 5.1
fixed: vendor fix RHSA-2012:0078
Red Hat JBoss Enterprise BRMS Platform 5.1
fixed: vendor fix RHSA-2012:0325
Red Hat Enterprise Linux (v. 5 server) tomcat5 5.5.23-0jpp.31.el5_8, tomcat5-jasper 5.5.23-0jpp.31.el5_8, tomcat5-webapps 5.5.23-0jpp.31.el5_8, tomcat5-common-lib 5.5.23-0jpp.31.el5_8, tomcat5-server-lib 5.5.23-0jpp.31.el5_8, tomcat5-jsp-2.0-api 5.5.23-0jpp.31.el5_8, +5 more Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5 5.5.23-0jpp.31.el5_8, tomcat5-jsp-2.0-api 5.5.23-0jpp.31.el5_8, tomcat5-servlet-2.4-api 5.5.23-0jpp.31.el5_8
fixed: vendor fix RHSA-2012:0474
Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, +3 more Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-jsp-2.1-api 6.0.24-36.el6_2, tomcat6-servlet-2.5-api 6.0.24-36.el6_2 Red Hat Enterprise Linux Server Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, tomcat6-admin-webapps 6.0.24-36.el6_2 Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-jsp-2.1-api 6.0.24-36.el6_2, tomcat6-servlet-2.5-api 6.0.24-36.el6_2 Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, tomcat6-admin-webapps 6.0.24-36.el6_2
fixed: vendor fix RHSA-2012:0475
Red Hat JBoss Enterprise Application Platform 4.3
fixed: vendor fix RHSA-2012:0041
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbossweb 2.1.12-3_patch_03.2.ep5.el5, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el5, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbossweb 2.1.12-3_patch_03.2.ep5.el6, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el6, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el6
fixed: vendor fix RHSA-2012:0074
Red Hat JBoss Enterprise Application Platform 5.1
fixed: vendor fix RHSA-2012:0075
Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server tomcat5 5.5.33-27_patch_07.ep5.el5, tomcat6 6.0.32-24_patch_07.ep5.el5, tomcat6-lib 6.0.32-24_patch_07.ep5.el5, tomcat6-log4j 6.0.32-24_patch_07.ep5.el5, tomcat5-jasper 5.5.33-27_patch_07.ep5.el5, tomcat5-parent 5.5.33-27_patch_07.ep5.el5, +17 more Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server tomcat5 5.5.33-28_patch_07.ep5.el6, tomcat6 6.0.32-24_patch_07.ep5.el6, tomcat6-lib 6.0.32-24_patch_07.ep5.el6, tomcat6-log4j 6.0.32-24_patch_07.ep5.el6, tomcat5-jasper 5.5.33-28_patch_07.ep5.el6, tomcat5-parent 5.5.33-28_patch_07.ep5.el6, +17 more
fixed: vendor fix RHSA-2012:0680

show 9 more

Red Hat JBoss Operations Network 2.4
fixed: vendor fix RHSA-2012:0089
Red Hat JBoss Operations Network 3.0
fixed: vendor fix RHSA-2012:0406
Red Hat JBoss Portal 4.3
fixed: vendor fix RHSA-2012:0091
Red Hat JBoss Portal 5.2 Red Hat JBoss SOA Platform 5.2
fixed: vendor fix RHSA-2012:0325
Red Hat JBoss Web Platform 5 for RHEL 5 Server jbossweb 2.1.12-3_patch_03.2.ep5.el5, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el5, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el5 Red Hat JBoss Web Platform 5 for RHEL 6 Server jbossweb 2.1.12-3_patch_03.2.ep5.el6, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el6, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el6
fixed: vendor fix RHSA-2012:0076
Red Hat JBoss Web Platform 5.1
fixed: vendor fix RHSA-2012:0077
Red Hat JBoss Web Server 1.0
fixed: vendor fix RHSA-2012:0679
Red Hat RHEL Desktop Workstation (v. 5 client) tomcat5 5.5.23-0jpp.31.el5_8, tomcat5-jasper 5.5.23-0jpp.31.el5_8, tomcat5-webapps 5.5.23-0jpp.31.el5_8, tomcat5-common-lib 5.5.23-0jpp.31.el5_8, tomcat5-server-lib 5.5.23-0jpp.31.el5_8, tomcat5-admin-webapps 5.5.23-0jpp.31.el5_8, +3 more
fixed: vendor fix RHSA-2012:0474
Red Hat JBoss Web Platform 5 for RHEL 4 AS jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2006-07-15 First public exploit (EDB-2012)
2012-01-05 Published

Exploit prediction

79.71% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/dos/http/hashcollision_dos Hashtable Collisions metasploit auxiliary, normal rank, 2011-12-28
EDB-2012 MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection webapps, 2006-07-15

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.tomcat:tomcat	>=5.5.0, <5.5.35 >=6.0.0, <6.0.35 >=7.0.0, <7.0.23	5.5.35 6.0.35 7.0.23

Classification

Weakness

CWE-399 Resource Management Errors
CWE-20 Improper Input Validation

References

debian.org /security/2012/dsa-2401
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2012-0325.html
vendor-advisory
marc.info /?l=bugtraq&m=136485229118404&w=2
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2012-0078.html
vendor-advisory
rhn.redhat.com /errata/RHSA-2012-0075.html
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2012-0074.html
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2012-0089.html
vendor-advisory
marc.info /?l=bugtraq&m=133294394108746&w=2
vendor-advisory, web
marc.info /?l=bugtraq&m=132871655717248&w=2
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2012-0406.html
vendor-advisory
rhn.redhat.com /errata/RHSA-2012-0076.html
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2012-0077.html
vendor-advisory
github.com /FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
web
nruns.com /_downloads/advisory28122011.pdf
web
securityfocus.com /bid/51200
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=750521
web
secunia.com /advisories/48791
third-party-advisory
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886
vdb-entry, signature, web
tomcat.apache.org /tomcat-7.0-doc/changelog.html
web
secunia.com /advisories/48549
third-party-advisory
secunia.com /advisories/54971
third-party-advisory
secunia.com /advisories/48790
third-party-advisory
secunia.com /advisories/55115
third-party-advisory
kb.cert.org /vuls/id/903934
third-party-advisory, web, us-government-resource
mail-archives.apache.org /mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e
mailing-list
ocert.org /advisories/ocert-2011-003.html
web
nvd.nist.gov /vuln/detail/CVE-2011-4858
advisory
github.com /apache/tomcat
package
mail-archives.apache.org /mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e
web

Sources

CVE List CVE-2011-4858
GitHub Advisory GHSA-wr3m-gw98-mc3j
NVD CVE-2011-4858

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary