Vulnerability advisory

CVE-2024-11941

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

Published Dec 5, 2024Updated Oct 28, 2026OSV record ↗

Severity

Affected versions

Affected commits	Fixed by commit
GIT git.drupalcode.org/project/drupal ↗
f6651882b4827e11aaeb8bd0a416e377539ba96d to before 4197bab425acfc129237f1ce904c1dd819ffa434	`4197bab425acfc129237f1ce904c1dd819ffa434`
a5d9f165ea7eab533e0bbc5cab7336b7e38e1d20 to before 32f756536f0e019797ee604fdf2822113b9db9e1	`32f756536f0e019797ee604fdf2822113b9db9e1`
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 32f756536f0e019797ee604fdf2822113b9db9e1	`32f756536f0e019797ee604fdf2822113b9db9e1`
f6651882b4827e11aaeb8bd0a416e377539ba96d to before 4197bab425acfc129237f1ce904c1dd819ffa434	`4197bab425acfc129237f1ce904c1dd819ffa434`
Also listed as affected (20) `10.1.7` `10.2.1` `10.2.0` `10.1.6` `10.1.5` `10.1.3` `10.1.2` `10.1.1` `10.1.0` `10.1.0-rc1` `10.1.0-beta1` `10.1.0-alpha1` `10.0.0-alpha5` `10.0.0-alpha4` `10.0.0-alpha3` `10.0.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0`

A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.