Read the docs
TI-2012-00774 Aliases CVE-2012-0839GHSA-7mh4-c5mx-6jq7

OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger…

Priority LOW 28CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

Why it matters now

EPSS 0.02654 85th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:inria:ocaml:*:*:*:*:*:*:*:*up to 3.12.1VulnerableInria
cpe:2.3:a:inria:ocaml:1.07:*:*:*:*:*:*:*1.07VulnerableInria
cpe:2.3:a:inria:ocaml:2.02:*:*:*:*:*:*:*2.02VulnerableInria
cpe:2.3:a:inria:ocaml:2.04:*:*:*:*:*:*:*2.04VulnerableInria
cpe:2.3:a:inria:ocaml:2.99:alpha:*:*:*:*:*:*2.99 alphaVulnerableInria
cpe:2.3:a:inria:ocaml:3.00:*:*:*:*:*:*:*3.00VulnerableInria
cpe:2.3:a:inria:ocaml:3.01:*:*:*:*:*:*:*3.01VulnerableInria
cpe:2.3:a:inria:ocaml:3.02:*:*:*:*:*:*:*3.02VulnerableInria
cpe:2.3:a:inria:ocaml:3.03:alpha:*:*:*:*:*:*3.03 alphaVulnerableInria
cpe:2.3:a:inria:ocaml:3.04:*:*:*:*:*:*:*3.04VulnerableInria
  • cpe:2.3:a:inria:ocaml:*:*:*:*:*:*:*:* Versions up to 3.12.1 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:1.07:*:*:*:*:*:*:* Versions 1.07 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:2.02:*:*:*:*:*:*:* Versions 2.02 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:2.04:*:*:*:*:*:*:* Versions 2.04 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:2.99:alpha:*:*:*:*:*:* Versions 2.99 alpha Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.00:*:*:*:*:*:*:* Versions 3.00 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.01:*:*:*:*:*:*:* Versions 3.01 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.02:*:*:*:*:*:*:* Versions 3.02 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.03:alpha:*:*:*:*:*:* Versions 3.03 alpha Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.04:*:*:*:*:*:*:* Versions 3.04 Vulnerable ·Inria
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:inria:ocaml:3.05:beta:*:*:*:*:*:*3.05 betaVulnerableInria
cpe:2.3:a:inria:ocaml:3.06:*:*:*:*:*:*:*3.06VulnerableInria
cpe:2.3:a:inria:ocaml:3.07:*:*:*:*:*:*:*3.07VulnerableInria
cpe:2.3:a:inria:ocaml:3.07:beta1:*:*:*:*:*:*3.07 beta1VulnerableInria
cpe:2.3:a:inria:ocaml:3.07:beta2:*:*:*:*:*:*3.07 beta2VulnerableInria
cpe:2.3:a:inria:ocaml:3.07:pl2:*:*:*:*:*:*3.07 pl2VulnerableInria
cpe:2.3:a:inria:ocaml:3.08:*:*:*:*:*:*:*3.08VulnerableInria
cpe:2.3:a:inria:ocaml:3.09:*:*:*:*:*:*:*3.09VulnerableInria
cpe:2.3:a:inria:ocaml:3.10:*:*:*:*:*:*:*3.10VulnerableInria
cpe:2.3:a:inria:ocaml:3.11:*:*:*:*:*:*:*3.11VulnerableInria
cpe:2.3:a:inria:ocaml:3.12:*:*:*:*:*:*:*3.12VulnerableInria
  • cpe:2.3:a:inria:ocaml:3.05:beta:*:*:*:*:*:* Versions 3.05 beta Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.06:*:*:*:*:*:*:* Versions 3.06 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.07:*:*:*:*:*:*:* Versions 3.07 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.07:beta1:*:*:*:*:*:* Versions 3.07 beta1 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.07:beta2:*:*:*:*:*:* Versions 3.07 beta2 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.07:pl2:*:*:*:*:*:* Versions 3.07 pl2 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.08:*:*:*:*:*:*:* Versions 3.08 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.09:*:*:*:*:*:*:* Versions 3.09 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Inria
  • cpe:2.3:a:inria:ocaml:3.12:*:*:*:*:*:*:* Versions 3.12 Vulnerable ·Inria

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-0839
  2. 2026-10-03 Alias added: GHSA-7mh4-c5mx-6jq7

References

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences