CVE-2024-11941
Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
- Record
CVE-2024-11941- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2024-3524
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
- Record
EUVD-2024-3524- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xq54-x54m-vcpx
Drupal core Denial of Service
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-xq54-x54m-vcpx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
- Record
CVE-2024-11941- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
- Record
CVE-2024-11941- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVGHSA-xq54-x54m-vcpx
Drupal core Denial of Service
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-xq54-x54m-vcpx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-11941
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
- Record
UBUNTU-CVE-2024-11941- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-drupal-2024-11941 No score
Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
- Record
BIT-drupal-2024-11941- Updated
- 2026-11-02
OSVDRUPAL-CORE-2024-001 No score
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
DRUPAL-CORE-2024-001- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
10.1.0 up to 10.1.8 | 10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2 | 10.2.2 |
drupalBitnami |
8.0.0 up to 10.2.4 | 10.2.4 |
drupal/corePackagist |
8.0.0 up to 10.1.8, 10.2.0 up to 10.2.2, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.2.18.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.3 |
10.1.810.2.2 |
drupal/corePackagist |
10.1.0 up to 10.1.8, plus listed versions 10.1.110.1.210.1.310.1.410.1.510.1.610.1.7 |
10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2, plus listed versions 10.2.1 |
10.2.2 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
drupal7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11941 is a high vulnerability (CVSS 7.5) in Drupal, published January 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in drupal/core 10.1.8.
References
drupal.org/sa-core-2024-001
nvd.nist.gov/vuln/detail/CVE-2024-11941
github.com/advisories/GHSA-xq54-x54m-vcpx
git.drupalcode.org/project/drupal
ubuntu.com/security/CVE-2024-11941
cve.org/CVERecord?id=CVE-2024-11941
Left out here: 283 versions. The JSON record has them.