Servers and applications

CVE-2016-9452

The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

Severity: Medium 6.5
Published: 25 Nov 2016
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Exploit chance: 1.7% in the next 30 daysHigher than 77% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness: Improper input validation (CWE-20)
Attack: Over the network · No login needed · Needs someone to click or open something
Attacker can: Take it down
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Sources: NVD

Affected software

Software Affected versions

Software	Affected versions
DrupalServers and applications · `cpe:a:drupal:drupal`	Version 8.2.2 Version 8.2.1 Version 8.2.0 Version 8.2.0-rc2 All 61 release lines Version 8.0.0-alpha2 Version 8.0.0-alpha3 Version 8.0.0-alpha4 Version 8.0.0-alpha5 Version 8.0.0-alpha6 Version 8.0.0-alpha7 Version 8.0.0-alpha8 Version 8.0.0-alpha9 Version 8.0.0-alpha10 Version 8.0.0-alpha11 Version 8.0.0-alpha12 Version 8.0.0-alpha13 Version 8.0.0-alpha14 Version 8.0.0-alpha15 Version 8.0.0-beta1 Version 8.0.0-beta2 Version 8.0.0-beta3 Version 8.0.0-beta4 Version 8.0.0-beta6 Version 8.0.0-beta7 Version 8.0.0-beta9 Version 8.0.0-beta10 Version 8.0.0-beta11 Version 8.0.0-beta12 Version 8.0.0-beta13 Version 8.0.0-beta14 Version 8.0.0-beta15 Version 8.0.0-beta16 Version 8.0.0-rc1 Version 8.0.0-rc2 Version 8.0.0-rc3 Version 8.0.0-rc4 Version 8.0.0 Version 8.0.1 Version 8.0.2 Version 8.0.3 Version 8.0.4 Version 8.0.5 Version 8.0.6 Version 8.1.0-beta1 Version 8.1.0-beta2 Version 8.1.0-rc1 Version 8.1.0 Version 8.1.1 Version 8.1.2 Version 8.1.3 Version 8.1.4 Version 8.1.5 Version 8.1.6 Version 8.1.7 Version 8.1.8 Version 8.1.9 Version 8.1.10 Version 8.2.0-beta1 Version 8.2.0-beta2 Version 8.2.0-beta3 Version 8.2.0-rc1 Version 8.2.0-rc2 Version 8.2.0 Version 8.2.1 Version 8.2.2

DrupalServers and applications · cpe:a:drupal:drupal

All 61 release lines