{"action":"opened","issue":{"url":"https://api.github.com/repos/JuliaLang/julia/issues/16172","repository_url":"https://api.github.com/repos/JuliaLang/julia","labels_url":"https://api.github.com/repos/JuliaLang/julia/issues/16172/labels{/name}","comments_url":"https://api.github.com/repos/JuliaLang/julia/issues/16172/comments","events_url":"https://api.github.com/repos/JuliaLang/julia/issues/16172/events","html_url":"https://github.com/JuliaLang/julia/issues/16172","id":152686453,"number":16172,"title":"Julia is vulnerable to HashDoS","user":{"login":"jdukes","id":601130,"avatar_url":"https://avatars.githubusercontent.com/u/601130?v=3","gravatar_id":"","url":"https://api.github.com/users/jdukes","html_url":"https://github.com/jdukes","followers_url":"https://api.github.com/users/jdukes/followers","following_url":"https://api.github.com/users/jdukes/following{/other_user}","gists_url":"https://api.github.com/users/jdukes/gists{/gist_id}","starred_url":"https://api.github.com/users/jdukes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdukes/subscriptions","organizations_url":"https://api.github.com/users/jdukes/orgs","repos_url":"https://api.github.com/users/jdukes/repos","events_url":"https://api.github.com/users/jdukes/events{/privacy}","received_events_url":"https://api.github.com/users/jdukes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-03T02:20:52Z","updated_at":"2016-05-03T02:20:52Z","closed_at":null,"body":"Julia uses the `hash` function in the `Dict` object when keys are strings. Under the hood this uses MurmurHash3. While for most input MurmurHash3 results in an optimal distribution, an attacker can craft input that will explicitly collide.\r\n\r\nAny system that takes untrusted input from users and passes it in to a Julia `Dict` becomes vulnerable to a Denial of Service commonly known as HashDoS. ([Here's a bit of extra info on the issue identified in most major web languages at the end of 2011](http://emboss.github.io/blog/2012/12/14/breaking-murmur-hash-flooding-dos-reloaded/)). The Julia web stack and JSON.jl are specifically vulnerable as they necessarily push untrusted input (headers, cookies, parameters, JSON) in to `Dict` objects."}}