CWE-328: Use of Weak Hash
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
84 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-41652 — Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches
- CVE-2025-27595 — Weak hashing alghrythm
- CVE-2024-48847 — MD5 bypass operation
- CVE-2026-32129 — Poseidon V1 variable-length input collision via implicit zero-padding
- CVE-2024-48924 — MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow
- CVE-2020-37168 — Ecommerce Systempay 1.0 Production Key Brute Force
- CVE-2025-47276 — Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2i
- CVE-2025-41256 — Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint
- CVE-2026-54266 — Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-27754 — SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
- CVE-2025-21604 — LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts
- CVE-2024-56516 — free-one-api uses md5 for password storage
- CVE-2026-41879 — Weak password hashing in R-SOFT DMS
- CVE-2025-31130 — gitoxide does not detect SHA-1 collision attacks
- CVE-2024-23589 — HCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerability
- CVE-2025-55053 — CWE-328: Use of Weak Hash
- CVE-2025-49197 — Deprecated TLS version supported
- CVE-2024-47829 — pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
- CVE-2024-10026 — Improved Seeding and Hashing In gVisor
- CVE-2026-40164 — jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed
Recently published
- CVE-2026-15605 — wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
- CVE-2026-41879 — Weak password hashing in R-SOFT DMS
- CVE-2026-14742 — langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
- CVE-2026-14738 — exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash
- CVE-2026-14630 — ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash
- CVE-2026-10540 — Weak password hash protection in Control-M/Entreprise Manager
- CVE-2026-13455 — PostgreSQL Anonymizer: Unrestricted function can leak the secret salt
- CVE-2026-53692 — Weak hashing algorithm in Redeight CMS
- CVE-2026-13510 — SimStudioAI sim Password Protection deployment.ts weak hash
- CVE-2026-13482 — skypilot-org skypilot User ID server.py username.encode weak hash
- CVE-2026-54266 — Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-48488 — phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
- CVE-2026-11481 — yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash
- CVE-2026-11479 — yoanbernabeu grepai Qdrant Backend chunker.go weak hash
- CVE-2026-11330 — thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash
- CVE-2026-11329 — onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash
- CVE-2026-10814 — milvus-io milvus Grantee ID Hash kv_catalog.go weak hash
- CVE-2026-10813 — LMCache KV Cache utils.py hex_hash_to_int16 weak hash
- CVE-2026-10812 — zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
- CVE-2026-10804 — Streamlit Palette hashing.py weak hash
More specific weaknesses
- CWE-916 — Use of Password Hash With Insufficient Computational Effort