CVE-2012-0876

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

• CWE-400

• http://bugs.python.org/issue13703#msg151870Issue Tracking, Third Party Advisory
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.htmlBroken Link, Mailing List
• http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.htmlBroken Link, Mailing List
• http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2012-0731.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0062.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
• http://secunia.com/advisories/49504Not Applicable
• http://secunia.com/advisories/51024Not Applicable
• http://secunia.com/advisories/51040Not Applicable
• http://sourceforge.net/projects/expat/files/expat/2.1.0/Release Notes, Third Party Advisory
• http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=10127Third Party Advisory
• http://www.debian.org/security/2012/dsa-2525Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:041Broken Link
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
• http://www.securityfocus.com/bid/52379Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1527-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1613-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1613-2Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365Broken Link
• https://support.apple.com/HT205637Third Party Advisory
• https://www.tenable.com/security/tns-2016-20Third Party Advisory
• http://bugs.python.org/issue13703#msg151870Issue Tracking, Third Party Advisory
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.htmlBroken Link, Mailing List
• http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.htmlBroken Link, Mailing List
• http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2012-0731.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0062.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
• http://secunia.com/advisories/49504Not Applicable
• http://secunia.com/advisories/51024Not Applicable
• http://secunia.com/advisories/51040Not Applicable
• http://sourceforge.net/projects/expat/files/expat/2.1.0/Release Notes, Third Party Advisory
• http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=10127Third Party Advisory
• http://www.debian.org/security/2012/dsa-2525Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:041Broken Link
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
• http://www.securityfocus.com/bid/52379Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1527-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1613-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1613-2Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365Broken Link
• https://support.apple.com/HT205637Third Party Advisory
• https://www.tenable.com/security/tns-2016-20Third Party Advisory

Published

Jul 3, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0870Heap-based buffer overflow in process.c in smbd in Samba 3.0…
• CVE-2012-0871The session_link_x11_socket function in login/logind-session…
• CVE-2012-0872Multiple cross-site scripting (XSS) vulnerabilities in OxWal…
• CVE-2012-0873Multiple cross-site scripting (XSS) vulnerabilities in Boone…
• CVE-2012-0874The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invo…
• CVE-2012-0875SystemTap 1.7, 1.6.7, and probably other versions, when unpr…
• CVE-2012-0877PyXML: Hash table collisions CPU usage Denial of Service7.5
• CVE-2012-0878Paste Script 1.7.5 and earlier does not properly set group m…
• CVE-2012-0879The I/O implementation for block devices in the Linux kernel…5.5
• CVE-2012-0880Apache Xerces-C++ allows remote attackers to cause a denial …
• CVE-2012-0881Apache Xerces2 Java Parser before 2.12.0 allows remote attac…
• CVE-2012-0882Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possib…