TI-2024-11078 Aliases CVE-2024-11941 GHSA-xq54-x54m-vcpx

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

LOW 39CWE-835Published 2024-12-05 · Updated 2024-12-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00476 41st percentileScored 2026-11-07

Fix Fixed Drupal Core (Drupal): 10.2.2, 10.1.8drupal/core (Packagist): 10.1.8, 10.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Drupal	Drupal Core	10.2.0 to before 10.2.2; 10.1.0 to before 10.1.8	10.2.2, 10.1.8	Patch available	CNA
—	drupal/core (Packagist)	10.1.0 to before 10.1.8	10.1.8	Patch available	GHSA-xq54-x54m-vcpx
—	drupal/core (Packagist)	10.2.0 to before 10.2.2	10.2.2	Patch available	GHSA-xq54-x54m-vcpx

Drupal Core VendorDrupal Affected 10.2.0 to before 10.2.2; 10.1.0 to before 10.1.8 Fixed in 10.2.2, 10.1.8 Patch available CNA
drupal/core (Packagist) Vendor— Affected 10.1.0 to before 10.1.8 Fixed in 10.1.8 Patch available GHSA-xq54-x54m-vcpx
drupal/core (Packagist) Vendor— Affected 10.2.0 to before 10.2.2 Fixed in 10.2.2 Patch available GHSA-xq54-x54m-vcpx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:drupal:drupal::::::::	8.0.0 to before 10.1.8; 10.2.0 to before 10.2.2	Vulnerable	Drupal

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.0.0 to before 10.1.8; 10.2.0 to before 10.2.2 Vulnerable ·Drupal

Remediation

Fix · CNA Drupal Core (Drupal) Fixed in 10.2.2, 10.1.8
Fix · GHSA-xq54-x54m-vcpx drupal/core (Packagist) Fixed in 10.1.8 Advisory →
Fix · GHSA-xq54-x54m-vcpx drupal/core (Packagist) Fixed in 10.2.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2024-11941
2026-10-03 Alias added: GHSA-xq54-x54m-vcpx

References

Advisory 2

Other 1

https://github.com/drupal/core

TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8

See all 278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences