CVE-2012-6051

FAUCET Score

CVE-2012-6051 describes a denial-of-service vulnerability in Google CityHash, where attackers can craft specific input to trigger hash collisions. This allows them to consume excessive CPU resources in applications using CityHash for hash tables. With a CVSS score of 5.0, this vulnerability has a network attack vector, low attack complexity, and results in partial availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:google:cityhash:-:::::::*

CVSS Data

CVSS version used by this source: 2.0

5.0MEDIUM

AV:N/AC:L/Au:N/C:N/I:N/A:P

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Exploitability Score

10.0

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

0.61%

Probability of exploitation in next 30 days

EPSS Percentile

45.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

This CVE's current EPSS score of 0.0061 is in the 29th percentile among its peer group of 23,701 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Advisories (1)

redhatCVE-2012-6051Moderate

xulrunner: Google CityHash hash function collisions (oCERT-2012-001)

Nov 23, 2012

References

2012.appsec-forum.ch / conferences

asfws12.files.wordpress.com / 2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf

code.google.com / p/cityhash/source/browse/trunk/NEWS

131002.net / data/talks/appsec12_slides.pdf