CVE-2024-11941

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

At a glance

Severity: HIGH 7.5
EPSS: EPSS 0.48 % · percentile 41 (2026-10-28)
State: PUBLISHED
Published: 2024-12-05
Updated: 2024-12-05
Assigner: drupal
NVD status: Analyzed

Description

A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

CWE-835

Advisories

DRUPAL-CORE-2024-001 — The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DO
GHSA-xq54-x54m-vcpx — Drupal core Denial of Service

European references

ENISA EUVD · EUVD-2024-3524
GCVE · GCVE-0-2024-11941

Affected configurations (NVD CPE)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.0.0 < 10.1.8
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 10.2.0 < 10.2.2

Affected products

Product	Versions
Drupal · Drupal Core	affected 10.2.0 < 10.2.2 ; affected 10.1.0 < 10.1.8

References

https://www.drupal.org/sa-core-2024-001

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD