CVE-2011-5034: Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability...

Security readout for executives and security teams

This is a denial-of-service issue in Apache Geronimo 2.2.1 and earlier. An attacker could send many specially crafted form parameters that force expensive hash handling, consuming CPU and degrading or stopping service availability. The sources do not show data theft or code execution. Exposure is most likely where Apache Geronimo 2.2.1 or earlier, or bundled Geronimo artifacts in dependent Java stacks, process attacker-controlled HTTP form parameters. Internet-facing services carry higher business impact than internal-only deployments. Handle during normal vulnerability remediation, with faster action for public-facing Geronimo services. The main risk is service outage, not confidentiality loss, and the supplied evidence does not show active exploitation. Mitigation focus: Inventory Apache Geronimo versions and bundled Geronimo artifacts in Java applications.; Upgrade affected Geronimo artifacts following Apache or vendor guidance.; Check dependent projects such as Axis2 or Karaf for Geronimo artifact updates..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.