glib2: hash table collisions CPU usage DoS
Published Jan 14, 2012
7.5
HIGHCVSS 3.1
EPSS 2.04%
Description
GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
Affected products
No data.
- ≤ 2.31.8
- 1.1.12
- 1.1.12-1
- 1.1.15
- 1.2.0
- 1.2.1
- 1.2.2
- 1.2.3
- 1.2.4
- 1.2.5
- 1.2.6
- 1.2.7
- 1.2.8
- 1.2.9
- 1.2.10
- 1.3.9
- 1.3.10
- 1.3.11
- 1.3.12
- 1.3.13
- 1.3.14
- 1.3.15
- 2.0
- 2.0.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- 2.0.6
- 2.0.7
- 2.1.0
- 2.1.1
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.3.0
- 2.3.1
- 2.3.2
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.4.4
- 2.4.5
- 2.4.6
- 2.4.7
- 2.4.8
- 2.5.0
- 2.5.1
- 2.5.2
- 2.5.3
- 2.5.4
- 2.5.5
- 2.5.6
- 2.5.7
- 2.6.0
- 2.6.1
- 2.6.2
- 2.6.3
- 2.6.4
- 2.6.5
- 2.6.6
- 2.7.0
- 2.7.1
- 2.7.2
- 2.7.3
- 2.7.4
- 2.7.5
- 2.7.6
- 2.7.7
- 2.8.0
- 2.8.1
- 2.8.2
- 2.8.3
- 2.8.4
- 2.8.5
- 2.8.6
- 2.9.0
- 2.9.1
- 2.9.2
- 2.9.3
- 2.9.4
- 2.9.5
- 2.9.6
- 2.10.0
- 2.10.1
- 2.10.2
- 2.10.3
- 2.11.0
- 2.11.1
- 2.11.2
- 2.11.3
- 2.11.4
- 2.12.0
- 2.12.1
- 2.12.2
- 2.12.3
- 2.12.4
- 2.12.5
- 2.12.6
- 2.12.7
- 2.12.8
- 2.12.9
- 2.12.10
- 2.12.11
- 2.12.12
- 2.12.13
- 2.13.0
- 2.13.1
- 2.13.2
- 2.13.3
- 2.13.4
- 2.13.5
- 2.13.6
- 2.13.7
- 2.14.0
- 2.14.1
- 2.14.2
- 2.14.3
- 2.14.4
- 2.14.5
- 2.14.6
- 2.15.0
- 2.15.1
- 2.15.2
- 2.15.3
- 2.15.4
- 2.15.5
- 2.15.6
- 2.16.0
- 2.16.1
- 2.16.2
- 2.16.3
- 2.16.4
- 2.16.5
- 2.16.6
- 2.17.0
- 2.17.1
- 2.17.2
- 2.17.3
- 2.17.4
- 2.17.5
- 2.17.6
- 2.17.7
- 2.18.0
- 2.18.1
- 2.18.2
- 2.18.3
- 2.18.4
- 2.19.0
- 2.19.1
- 2.19.2
- 2.19.3
- 2.19.4
- 2.19.5
- 2.19.6
- 2.19.7
- 2.19.8
- 2.19.9
- 2.19.10
- 2.20.0
- 2.20.1
- 2.20.2
- 2.20.3
- 2.20.4
- 2.20.5
- 2.21.0
- 2.21.1
- 2.21.2
- 2.21.3
- 2.21.4
- 2.21.5
- 2.21.6
- 2.22.0
- 2.22.1
- 2.22.2
- 2.22.3
- 2.22.4
- 2.22.5
- 2.23.0
- 2.23.1
- 2.23.2
- 2.23.3
- 2.23.4
- 2.23.5
- 2.23.6
- 2.24.0
- 2.24.1
- 2.24.2
- 2.25.0
- 2.25.1
- 2.25.2
- 2.25.3
- 2.25.4
- 2.25.5
- 2.25.6
- 2.25.7
- 2.25.8
- 2.25.9
- 2.25.10
- 2.25.11
- 2.25.12
- 2.25.13
- 2.25.14
- 2.25.15
- 2.25.16
- 2.25.17
- 2.26.0
- 2.26.1
- 2.27.0
- 2.27.1
- 2.27.2
- 2.27.3
- 2.27.4
- 2.27.5
- 2.27.90
- 2.27.91
- 2.27.92
- 2.27.93
- 2.28
- 2.28.0
- 2.28.1
- 2.28.2
- 2.28.3
- 2.28.4
- 2.28.5
- 2.28.6
- 2.28.7
- 2.28.8
- 2.29.2
- 2.29.4
- 2.29.6
- 2.29.8
- 2.29.10
- 2.29.12
- 2.29.14
- 2.29.16
- 2.29.18
- 2.29.90
- 2.29.92
- 2.30.0
- 2.30.1
- 2.30.2
- 2.31.0
- 2.31.2
- 2.31.4
- 2.31.6
No data.
Red Hat Enterprise Linux 4
glib2
Affected
Red Hat Enterprise Linux 5
glib2
Affected
Red Hat Enterprise Linux 6
glib2
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 4 | glib2 | Affected | n/a |
| Red Hat Enterprise Linux 5 | glib2 | Affected | n/a |
| Red Hat Enterprise Linux 6 | glib2 | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Jan 21, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (12 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 2.04% (0.02043) | 80.45th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.16% (0.02162) | 79.78th | v5 (v2026.06.15) |
| Mar 30, 2025 | 0.49% (0.00489) | 62.70th | v4 (v2025.03.14) |
| Mar 29, 2025 | 1.66% (0.01657) | 70.57th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.49% (0.00489) | 63.43th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.15% (0.00155) | 53.18th | v3 (v2023.03.01) |
| Jun 14, 2024 | 0.15% (0.00155) | 52.00th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.15% (0.00155) | 49.98th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.02% (0.01018) | 40.69th | v2 (v2022.01.01) |
| Sep 10, 2022 | 1.02% (0.01018) | 38.88th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.02% (0.01018) | 36.86th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.02% (0.01018) | 19.50th | v2 (v2022.01.01) |
References (7)
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655044
- http://mail.gnome.org/archives/gtk-devel-list/2003-May/msg00111.html mailing-list
- http://openwall.com/lists/oss-security/2012/01/10/12 mailing-list
- https://access.redhat.com/security/cve/CVE-2012-0039 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=772720 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2012-0039
- https://www.cve.org/CVERecord?id=CVE-2012-0039
Change history (0)
No recorded changes yet.