Drupal Denial of service via transliterate mechanism

MEDIO 6.5CVE-2016-9452 · GHSA-jpj8-49hr-wcwv · Published 25/11/2016 · updated 17/06/2026

En resumen

CVE-2016-9452 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a drupal/core, drupal/drupal, drupal (drupal).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.7%, mayor que el 77.5% de las vulnerabilidades.
Solución: actualizar a 8.2.3 o posterior.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 8.0, < 8.2.3`	`8.2.3`
drupal/drupal Packagist	`≥ 8.0, < 8.2.3`	`8.2.3`
drupal drupal	`= 8.0.0= 8.0.1= 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.1.0= 8.1.1= 8.1.10= 8.1.2= 8.1.3= 8.1.4= 8.1.5= 8.1.6= 8.1.7= 8.1.8= 8.1.9= 8.2.0= 8.2.1= 8.2.2`	No fix yet

Description

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

NVD description

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

References

nvd.nist.gov/vuln/detail/CVE-2016-9452 · ADVISORY
FriendsOfPHP/security-advisories · WEB
FriendsOfPHP/security-advisories · WEB
drupal/core · PACKAGE
drupal.org/SA-CORE-2016-005 · WEB
securityfocus.com/bid/94367 · WEB

Más vulnerabilidades de drupal/core

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

drupal/core

Packagist

≥ 8.0, < 8.2.3

8.2.3

drupal/drupal

Packagist

≥ 8.0, < 8.2.3

8.2.3

drupal

= 8.0.0= 8.0.1= 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.1.0= 8.1.1= 8.1.10= 8.1.2= 8.1.3= 8.1.4= 8.1.5= 8.1.6= 8.1.7= 8.1.8= 8.1.9= 8.2.0= 8.2.1= 8.2.2

No fix yet

Más vulnerabilidades de drupal/core

Ver todo →