Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

OCaml 3.12.1 and earlier can be slowed by crafted input

CVE-2012-0839 · published 14 years ago
Summary

OCaml versions up to 3.12.1 calculate lookup keys in a way that an attacker can make many of them end up in the same spot in a table. This forces the program to use a lot of processing power and can make it unresponsive. Upgrade OCaml to a newer version or apply the available patch to fix the calculation, and avoid feeding untrusted data directly into such tables.

What to do
  • Update debian ocaml to version 4.00.0~beta2-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian ocaml < 4.00.0~beta2-1
Fix: upgrade to 4.00.0~beta2-1
Debian:13 debian ocaml < 4.00.0~beta2-1
Fix: upgrade to 4.00.0~beta2-1
Debian:14 debian ocaml < 4.00.0~beta2-1
Fix: upgrade to 4.00.0~beta2-1
– inria ocaml <= 3.12.1
1.07
2.02
2.04
2.99
3.00
3.01
3.02
3.03
3.04
3.05
3.06
6 more version ranges
cpe:2.3:a:inria:ocaml:*:*:*:*:*:*:*:*
Original advisory text
OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU cons...
OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
References
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published8 Feb 2012
Updated30 Oct 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-0839 · OSV
CVE-2012-0839 · NVD
Track software like this
Free during beta