CVE-2012-0039: GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the...

Security readout for executives and security teams

This issue affects applications that use GLib string hashing with attacker-controlled strings. Predictable hash collisions can force excessive CPU work and cause denial of service. The risk is context-dependent, and the CVE notes vendor dispute: g_str_hash itself is not necessarily a library vulnerability when applications can choose a suitable hash function. Exposure is most plausible in network-facing or user-input-driven applications using GLib GHashTable with g_str_hash for attacker-controlled string keys. The source bundle does not identify specific affected products or CPEs beyond GLib 2.31.8 and earlier. Treat this as a targeted availability risk rather than a broad compromise issue. Prioritize review for internet-facing services or high-traffic parsers using older GLib patterns. Lower urgency applies where hash-table keys are internal, bounded, or not attacker-controlled. Mitigation focus: Inventory GLib versions and applications using GHashTable with string keys.; Check GNOME, Debian, and Red Hat guidance for package-specific fixes or positions.; For risky call sites, use an application-appropriate hash function instead of g_str_hash..

Prepared

May 24, 2026, 09:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.