CVE-2012-6051: Google CityHash computes hash values without properly restricting the ability to trigger hash collisions pr...

Security readout for executives and security teams

CityHash can be predictable enough that specially chosen inputs may force many hash collisions. If an application uses it in hash tables for untrusted data, CPU usage can spike and service availability may degrade. The source bundle does not identify specific affected products or versions. Exposure is most likely in applications that use Google CityHash for hash-table keys derived from attacker-controlled input. The bundle lists affected product and version data as n/a, so exposure requires local code or dependency review. Treat this as a targeted availability risk, not a broad remote compromise based on the provided evidence. Prioritize systems where public traffic can influence hash-table keys and where CPU exhaustion would affect customer-facing services. Mitigation focus: Check current CityHash and vendor guidance for fixes or replacement advice.; Inventory CityHash usage in code and dependencies.; Avoid CityHash for adversarial hash-table inputs where feasible..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.