{"id":"CVE-2014-9016","aliases":["DSA-3075-1","EUVD-2014-8844","GHSA-cfc7-w9hw-779w","MGASA-2014-0492","UBUNTU-CVE-2014-9016"],"status":"published","title":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass)...","description":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.79056,"percentile":0.99599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2014-11-20T00:00:00Z","modified":"2026-06-17T00:17:39Z","exploits":[{"source":"exploitdb","id":"EDB-35415","title":"Drupal \u003c 7.34 - Denial of Service","type":"dos","platform":"php","date":"2014-12-01","url":"https://www.exploit-db.com/exploits/35415"},{"source":"pocgithub","id":"c0r3dump3d/wp_drupal_timing_attack","title":"c0r3dump3d/wp_drupal_timing_attack","date":"2014-12-01","url":"https://github.com/c0r3dump3d/wp_drupal_timing_attack"},{"source":"pocgithub","id":"Primus27/WordPress-Long-Password-Denial-of-Service","title":"Primus27/WordPress-Long-Password-Denial-of-Service","date":"2020-02-08","url":"https://github.com/Primus27/WordPress-Long-Password-Denial-of-Service"},{"source":"metasploit","id":"auxiliary/dos/http/wordpress_long_password_dos","title":"WordPress Long Password DoS","type":"auxiliary","date":"2014-11-20","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_long_password_dos"}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u8"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"},{"vendor":"secure_password_hashes_project","product":"secure_passwords_hashes"}],"references":[{"url":"https://www.drupal.org/node/2378375","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/20/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://www.drupal.org/SA-CORE-2014-006","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/20/21","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://secunia.com/advisories/59164","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"https://www.drupal.org/node/2378367","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://secunia.com/advisories/59814","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3075","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9016"},{"url":"https://github.com/advisories/GHSA-cfc7-w9hw-779w"},{"url":"https://advisories.mageia.org/MGASA-2014-0492.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14614","tags":["report"]},{"url":"https://drupal.org/drupal-7.33","tags":["web"]},{"url":"https://drupal.org/drupal-7.33-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.34","tags":["web"]},{"url":"https://drupal.org/drupal-7.34-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-3075","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9016","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9016","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9016","description":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","status":"published","published":"2014-11-24T15:00:00Z","modified":"2024-08-06T13:33:13.282Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-8844","description":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","status":"published","published":"2014-11-24T15:00:00Z","modified":"2024-08-06T13:33:13Z","updated_at":"2026-11-03T01:56:50.141542Z"}],"ghsa":[{"id":"GHSA-cfc7-w9hw-779w","title":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass)...","description":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","status":"published","published":"2022-05-13T01:10:45Z","modified":"2023-02-01T05:03:39Z","updated_at":"2026-11-02T14:50:05.685198Z"}],"nvd":[{"id":"CVE-2014-9016","description":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","status":"published","published":"2014-11-24T15:59:17.92Z","modified":"2026-06-17T00:17:39.537Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"DSA-3075-1","title":"drupal7 - security update","status":"published","published":"2014-11-20T00:00:00Z","modified":"2026-03-09T01:21:03.197006Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0492","title":"Updated drupal packages fix security vulnerabilities","description":"Updated drupal packages fix security vulnerability:\n\nAaron Averill discovered that a specially crafted request can give a user\naccess to another user's session, allowing an attacker to hijack a random\nsession (CVE-2014-9015).\n\nMichael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the\npassword hashing API allows an attacker to send specially crafted requests\nresulting in CPU and memory exhaustion. This may lead to the site becoming\nunavailable or unresponsive (denial of service) (CVE-2014-9016).\nanonymous users (CVE-2014-9016).\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:25:28.648268751Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-9016","description":"The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","status":"published","published":"2014-11-24T15:59:00Z","modified":"2025-09-08T16:43:15Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}