Adobe ColdFusion 8.0 8.0.1 9.0 and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.