Tomcat and Hashtable collision Denial of Service Vulnerability

You may have heard about the hash table implementation vulnerability in Java before. Now, Tomcat uses a hash table to store HTTP request parameters, which is also affected. So far, Oracle has not provided patches for this issue.

For this reason, Tomcat implements a work und. A new option maxParameterCount is provided to limit the maximum number of parameters in the request. The default value of this parameter is 10000, which is sufficient for most applications, this value is enough to bypass the hash table bug in JRE.

Currently, this work und will be implemented in the following versions:

Trunk
7.0.23 onwards
6.0.35 onwards

This method will also be implemented in the version 5.5.35 to be released.

If you are using an earlier version of Tomcat without the maxParameterCount attribute, you can solve this problem by limiting maxPostSize to less than 10 KB.

Although this is not a bug in Tomcat itself, the Tomcat security team still published the message and informed the potential problems.

For more information about this vulnerability, see

Http://www.nruns.com/_downloads/advisory28122011.pdf