SA-CORE-2025-005: Critical severity Drupal Drupal vulnerability
Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests receiving inappropriate cached responses (cache poisoning). This could be exploited in various ways:
Broken rendering of some pages Unstyled or malformatted pages Adverse impacts on client-side functionality
Changes are being made in the underlying library which will mitigate this problem, but in the meantime Drupal core has been hardened to protect against this vulnerability. The authors of the underlying library do not believe it is a source of vulnerabilities in other systems. Drupal's use of library leads to an implementation-specific vulnerability, so we've issued this advisory and reserved a CVE ID for the vulnerability in Drupal.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2025-005?
The severity of SA-CORE-2025-005 is considered moderate.
How do I fix SA-CORE-2025-005?
To fix SA-CORE-2025-005, update your Drupal installation to a version beyond the affected releases, specifically 10.4.10, 10.5.7, 11.1.10, or 11.2.9.
What are the affected versions for SA-CORE-2025-005?
The affected versions for SA-CORE-2025-005 include Drupal 10.4.9, 10.5.6, 11.1.9, and 11.2.8.
Can SA-CORE-2025-005 be exploited remotely?
Yes, SA-CORE-2025-005 can potentially be exploited remotely, leading to unintended caching of sensitive response data.
What features of Drupal are impacted by SA-CORE-2025-005?
SA-CORE-2025-005 impacts the feature that allows certain attributes of incoming HTTP requests to be overridden.