Comment by jongjong

Interesting! That said, these examples appear to be crafted in a special way to cause the collision. In a practical scenario with normal usage, I suspect it would be essentially impossible. Sure, it can be a problem in some niche scenarios with a determined attacker but a collision would just mean that the user is not able to create the resource (the system would falsely indicate that the resource already exists); but that's not too bad. At worst, it would reveal the existence of a resource with a specific UUID, but could the attacker have achieved the collision if they didn't know the target UUID already? It doesn't seem like a viable attack given how little information it gives you.