PT-2024-9530 · Drupal · Drupal Core

Alexander Antonenko + 5 · Published 2024-01-17 · Updated 2025-06-03 · CVE-2024-11941

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Drupal Core versions 10.2.0 through 10.2.1 Drupal Core versions 10.1.0 through 10.1.7

Description A vulnerability in Drupal Core allows Excessive Allocation, which can be exploited to trigger a denial of service (DOS). The issue affects certain versions of Drupal Core.

Recommendations For versions 10.2.0 through 10.2.1, update to version 10.2.2 or later. For versions 10.1.0 through 10.1.7, update to version 10.1.8 or later. As a temporary workaround, consider disabling the Comment module to minimize the risk of exploitation.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2024-11232

BIT-DRUPAL-2024-11941

CVE-2024-11941

DRUPAL-CORE-2024-001

GHSA-XQ54-X54M-VCPX

Affected Products

Drupal Core

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-11941 · Vendor Advisory
• https://drupal.org/sa-core-2024-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11941 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11941 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-11941 · Security Note
• https://bdu.fstec.ru/vul/2024-11232 · Security Note
• https://ubuntu.com/security/CVE-2024-11941 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2024-11941 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xq54-x54m-vcpx · Vendor Advisory
• https://github.com/drupal/core · Note
• https://twitter.com/CCBalert/status/1865036829658931483 · Twitter Post
• https://t.me/cvedetector/12109 · Telegram Post
• https://github.com/advisories/GHSA-xq54-x54m-vcpx · Note
• https://twitter.com/VulmonFeeds/status/1864765551588851994 · Twitter Post
• https://twitter.com/CVEnew/status/1864683976285409630 · Twitter Post