Which products and versions are affected by CVE-2011-5034?

Affected: Geronimo (Apache) versions 1.0, 1.1, 1.1.1, 1.2, 2.0.1, 2.0.2, 2.1, 2.1.1; org.apache.geronimo:geronimo (maven). The full list is in the CVE brief.

Is CVE-2011-5034 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2011-5034 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2011-5034?

Public exploit code is available.

Is there a fix for CVE-2011-5034?

Fixed versions are available, including Geronimo 2.2.1, org.apache.geronimo:geronimo 2.2.1.

How urgently should CVE-2011-5034 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2011-5034

MediumPublic exploit

Apache Geronimo Hash Collisions Cause DoS

Published May 13, 2022 · Updated Dec 7, 2024 · Also known as GHSA-v3h8-rw48-h4gr

Key Facts

Patch immediately

CVE-2011-5034 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Geronimo (Apache), org.apache.geronimo:geronimo (maven).
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 81% probability of exploitation in the next 30 days.
Fixed versions are available, including Geronimo 2.2.1, org.apache.geronimo:geronimo 2.2.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS (30-day exploit likelihood)

81%

Higher than 99.6% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2011-5034 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

Affected Products

18 affected entries in total

Product	Affected versions	Fixed in
GeronimoApache	1.0, 1.1, 1.1.1, 1.2, 2.0.1, 2.0.2, 2.1, 2.1.1	2.2.1
org.apache.geronimo:geronimomaven	See advisory	2.2.1

Patched Releases

Geronimo

2.2.1

org.apache.geronimo:geronimo

2.2.1

Timeline

Publicly disclosed
May 13, 2022
Last updated
Dec 7, 2024

Weakness Type

CWE-20 Improper Input Validation
CWE-400 Uncontrolled Resource Consumption

References

15 more references in the full CVE brief

FAQ

Common Questions.

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Affected: Geronimo (Apache) versions 1.0, 1.1, 1.1.1, 1.2, 2.0.1, 2.0.2, 2.1, 2.1.1; org.apache.geronimo:geronimo (maven). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Geronimo 2.2.1, org.apache.geronimo:geronimo 2.2.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2011-5034 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.