  We present an explicit formula that produces hash collisions for the
Merkle-Damg{\aa}rd construction. The formula works for arbitrary choice of
message block and irrespective of the standardized constants used in hash
functions, although some padding schemes may cause the formula to fail. This
formula bears no obvious practical implications because at least one of any
pair of colliding messages will have length double exponential in the security
parameter. However, due to ambiguity in existing definitions of collision
resistance, this formula arguably breaks the collision resistance of some hash
functions.
