CVE-2024-11941

What it actually does

Crafted comment reply requests to the Comment module can trigger excessive resource consumption or processing loops resulting in denial of service.

Why it matters to the business

Drupal sites using the Comment module may experience unplanned downtime, degraded performance, and loss of availability for visitors until the issue is remediated.

How an attack unfolds

An unauthenticated or low-privileged attacker repeatedly submits specially formed comment reply requests that the application fails to handle efficiently, exhausting server resources and rendering the site unresponsive.

How to fix it

Upgrade Drupal to a fixed version containing commit 32f756536f0e019797ee604fdf2822113b9db9e1. Disable or restrict the Comment module if immediate patching is not feasible.

How to confirm the fix worked

Confirm the installed Drupal core version includes commit 32f756536f0e019797ee604fdf2822113b9db9e1, review changelog entries for the fix, and test that comment reply functionality no longer permits resource exhaustion under load.

Typical attack path

1. Identify a Drupal site with the Comment module enabled and public or authenticated comment functionality
2. Craft and send repeated comment reply requests with parameters that trigger the vulnerable code path
3. Monitor for resource exhaustion or service unavailability on the target application

How to detect it

Review web server and application logs for high volumes of POST requests to comment reply endpoints from single or distributed sources; correlate with spikes in CPU or memory usage during the same timeframe.

What your security team should do

• Apply the fixed Drupal commit immediately on all affected instances
• Temporarily disable the Comment module or restrict reply permissions for untrusted users until patched
• Monitor application performance metrics and logs for signs of resource exhaustion