CVE-2012-1150

Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

• CWE-310

• http://bugs.python.org/issue13703Exploit
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
• http://mail.python.org/pipermail/python-dev/2011-December/115116.html
• http://mail.python.org/pipermail/python-dev/2012-January/115892.html
• http://python.org/download/releases/2.6.8/Patch, Vendor Advisory
• http://python.org/download/releases/2.7.3/Patch, Vendor Advisory
• http://python.org/download/releases/3.1.5/Patch, Vendor Advisory
• http://python.org/download/releases/3.2.3/Patch, Vendor Advisory
• http://secunia.com/advisories/50858
• http://secunia.com/advisories/51087
• http://secunia.com/advisories/51089
• http://www.openwall.com/lists/oss-security/2012/03/10/3
• http://www.ubuntu.com/usn/USN-1592-1
• http://www.ubuntu.com/usn/USN-1596-1
• http://www.ubuntu.com/usn/USN-1615-1
• http://www.ubuntu.com/usn/USN-1616-1
• https://bugzilla.redhat.com/show_bug.cgi?id=750555
• http://bugs.python.org/issue13703Exploit
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
• http://mail.python.org/pipermail/python-dev/2011-December/115116.html
• http://mail.python.org/pipermail/python-dev/2012-January/115892.html
• http://python.org/download/releases/2.6.8/Patch, Vendor Advisory
• http://python.org/download/releases/2.7.3/Patch, Vendor Advisory
• http://python.org/download/releases/3.1.5/Patch, Vendor Advisory
• http://python.org/download/releases/3.2.3/Patch, Vendor Advisory
• http://secunia.com/advisories/50858
• http://secunia.com/advisories/51087
• http://secunia.com/advisories/51089
• http://www.openwall.com/lists/oss-security/2012/03/10/3
• http://www.ubuntu.com/usn/USN-1592-1
• http://www.ubuntu.com/usn/USN-1596-1
• http://www.ubuntu.com/usn/USN-1615-1
• http://www.ubuntu.com/usn/USN-1616-1
• https://bugzilla.redhat.com/show_bug.cgi?id=750555

Published

Oct 5, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1144FreeType before 2.4.9, as used in Mozilla Firefox Mobile bef…
• CVE-2012-1145spacewalk-backend in Red Hat Network Satellite 5.4 on Red Ha…
• CVE-2012-1146The mem_cgroup_usage_unregister_event function in mm/memcont…5.5
• CVE-2012-1147readfilemap.c in expat before 2.1.0 allows context-dependent…
• CVE-2012-1148Memory leak in the poolGrow function in expat/lib/xmlparse.c…
• CVE-2012-1149Integer overflow in the vclmi.dll module in OpenOffice.org (…
• CVE-2012-1151Multiple format string vulnerabilities in dbdimp.c in DBD::P…
• CVE-2012-1152Multiple format string vulnerabilities in the error reportin…
• CVE-2012-1153Unrestricted file upload vulnerability in addons/uploadify/u…
• CVE-2012-1154mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4…
• CVE-2012-1155Moodle has a database activity export permission issue where…7.5
• CVE-2012-1156Moodle before 2.2.2 has users' private files included in cou…7.5