defnull/bottle — comment on commit 6946695b69f5493fb063c351400ff759323a31aa
File:  line 0
By gpshead:

Not a fix. Using a hash table at all is "vulnerable" in as much as anyone actually cares about this. Even a randomized hash function like Perl has can be remotely probed to figure enough about it to still mount a targeted DOS. But so what?

The real solution is to do overall input sanity checking _before_ ever storing any input as a key in a hash table. As a last resort you need to set cpu time hard limits on your processes so that they die if they exceed them.