CVE-2012-0785

Vulnerability

Overview

CVE-2012-0785 describes a hash collision attack vulnerability in Jenkins (formerly Hudson) that allows remote attackers to cause excessive CPU load, effectively a denial of service [1][2]. The root cause lies in the built-in Winstone servlet container, which Jenkins uses when running from java -jar jenkins.war. By sending a small number of HTTP parameters with specially crafted keys that deliberately produce hash collisions, the attacker forces the parameter-map data structure into worst-case O(n²) insertion performance, consuming large amounts of CPU time [4].

Attack

Vector and Prerequisites

The vulnerability is exploitable remotely without authentication. The attacker only needs network access to the Jenkins instance. The attack does not require valid credentials; the crafted POST or GET request with colliding parameter names triggers the CPU spike on the server. However, the issue only affects users running Jenkins directly via the Winstone container; those deploying Jenkins under other servlet containers (e.g., Tomcat) are not affected at the Jenkins level, though those containers may have their own hash-DoS fixes [4].

Impact

A successful exploitation results in a denial of service: the Jenkins server becomes unresponsive or very slow for legitimate users due to high CPU consumption. The vulnerability does not allow data exfiltration or privilege escalation; its severity is medium because it is easy to exploit with readily available attack code [4].

Mitigation

Fixed versions are: Jenkins mainline 1.447, LTS 1.424.2, Jenkins Enterprise by CloudBees 1.424.2.1 and 1.400.0.11 [2][4]. Users on affected versions should upgrade immediately. No workaround for Winstone-based deployments is mentioned aside from upgrading. The fix typically involves using a hash function with randomization (e.g., adding a per-instance secret to parameter hashing) to prevent predictable collisions.