Rapid7’s 2026 Global Cybersecurity Summit is now available on-demand.Watch sessions.
Rapid7

module

Hashtable Collisions

Disclosed
Dec 28, 2011

Description

This module uses a denial-of-service (DoS) condition appearing in a variety of
programming languages. This vulnerability occurs when storing multiple values
in a hash table and all values have the same hash value. This can cause a web server
parsing the POST parameters issued with a request into a hash table to consume
hours of CPU with a single HTTP request.

Currently, only the hash functions for PHP and Java are implemented.
This module was tested with PHP + httpd, Tomcat, Glassfish and Geronimo.
It also generates a random payload to bypass some IDS signatures.
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.