CVE-2024-11941: Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
Other sources
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11941?
The severity of CVE-2024-11941 is currently classified as high due to excessive allocation vulnerabilities in Drupal Core.
How do I fix CVE-2024-11941?
To fix CVE-2024-11941, update your Drupal Core to version 10.2.2 or 10.1.8 or later.
Who is affected by CVE-2024-11941?
CVE-2024-11941 affects users of Drupal Core versions 10.2.0 through 10.2.1 and 10.1.0 through 10.1.7.
What impact does CVE-2024-11941 have?
CVE-2024-11941 can potentially allow attackers to exploit excessive allocation, affecting the performance and stability of the system.
When was CVE-2024-11941 disclosed?
CVE-2024-11941 was disclosed in early 2024 and addresses vulnerabilities in the Comment module of Drupal.