CVE-2025-13080
Project: Drupal core Date: 2025-November-12 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Denial of Service Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13080 Description: Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests receiving inappropriate cached responses (cache poisoning). This could be exploited in various ways: Broken rendering of some pages Unstyled or malformatted pages Adverse impacts on client-side functionality Changes are being made in the underlying library which will mitigate this problem, but in the meantime Drupal core has been hardened to protect against this vulnerability. The authors of the underlying library do not believe it is a source of vulnerabilities in other systems. Drupal's use of library leads to an implementation-specific vulnerability, so we've issued this advisory and reserved a CVE ID for the vulnerability in Drupal. Solution: Install the latest version: If you are using Drupal 10.4, update to Drupal 10.4.9 . If you are using Drupal 10.5, update to Drupal 10.5.6 . If you are using Drupal 11.1, update to Drupal 11.1.9 . If you are using Drupal 11.2, update to Drupal 11.2.8 . Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. ( Drupal 8 and Drupal 9 have both reached end-of-life.) Reported By: Dragos Dumitrescu (dragos-dumi) yasser ALLAM (inzo_) Nils Destoop (nils.destoop) Sven Decabooter (svendecabooter) zhero Fixed By: Alex Pott (alexpott) of the Drupal Security Team catch (catch) of the Drupal Security Team cilefen (cilefen) of the Drupal Security Team Jen Lampton (jenlampton) , provisional member of the Dru
CSIRTS triage
- What
- A feature can be abused to cause cache poisoning, leading to denial of service.
- Who is affected
- Users of Drupal core versions within the specified range.
- Urgency
- Remediation is urgent due to the potential for service disruption.
- Action
- Upgrade to a version that addresses this vulnerability.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2025-13080
Get an email if CVE-2025-13080 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Advisory coverage (1)
- criticalDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005drupal · 2025-11-12
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2025-13080)