From http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6051

> Google CityHash computes hash values without properly restricting the 
> ability to trigger hash collisions predictably, which allows context-
> dependent attackers to cause a denial of service (CPU consumption) via 
> crafted input to an application that maintains a hash table, as 
> demonstrated by a universal multicollision attack.

Given that the NEWS file does not mention this, is v1.1.0 affected?