Project:
Date:
2025-May-14
Vulnerability:
Denial of Service
Affected versions:
<3.1.11 || >=4.0.0 <4.0.2
CVE IDs:
CVE-2025-4416
Description:
The Events Log Track module enables you to log specific events on a Drupal site.
The module doesn't sufficiently mitigate resource consumption for certain requests which allows a Denial of Service attack.
Solution:
Install the latest version:
- If you use the event_log_track_auth_user_login_validate sub-module for Drupal 10.x or 11.x, upgrade to events_log_track 4.0.2 or events_log_track 3.1.11
Reported By:
Fixed By:
- Mingsong (mingsong) Provisional Member of the Drupal Security Team
- Stephen Mustgrave (smustgrave)
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
