CVE-2024-11941 Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
An excessive allocation flaw in Drupal core allows attackers to cause a denial of service by triggering resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-11941?
CVE-2024-11941 is a high-severity denial of service vulnerability in Drupal Drupal, published on 5 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
Weakness: CWE-835
Which versions are affected by CVE-2024-11941?
6 open source packages ship an affected version, including drupal/core and drupal. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 10.1.0 | 10.1.8 |
drupal/core Packagist | From 10.1.0 | 10.1.8 |
drupal/core Packagist | From 10.2.0 | 10.2.2 |
drupal/core Packagist | From 10.2.0 | 10.2.2 |
drupal/core Packagist | From 8.0.0 | 10.1.8, 10.2.2 |
drupal Bitnami | From 8.0.0 | 10.2.4 |
Products include Drupal Drupal.
How do I fix CVE-2024-11941?
Upgrade drupal/core to a fixed version for your release line: 10.1.8 or 10.2.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-11941 being exploited?
There is no known exploitation of CVE-2024-11941 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2024-11941, DRUPAL-CORE-2024-001, GHSA-xq54-x54m-vcpx, UBUNTU-CVE-2024-11941.