CVE-2014-5019
Description
A crafted HTTP Host header can cause a denial of service in Drupal multisite by forcing the use of incorrect configuration, affecting 6.x before 6.32 and 7.x before 7.29.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A crafted HTTP Host header can cause a denial of service in Drupal multisite by forcing the use of incorrect configuration, affecting 6.x before 6.32 and 7.x before 7.29.
Vulnerability
The multisite feature in Drupal core, which dynamically determines the configuration file based on the HTTP Host header, fails to properly validate maliciously crafted header values [1]. This vulnerability affects all Drupal 6.x versions before 6.32 and Drupal 7.x versions before 7.29, including sites that do not actually use the multisite feature [1].
Exploitation
An attacker can exploit this vulnerability by sending a specially crafted HTTP Host header to any Drupal site running an affected version [1]. No authentication or special privileges are required; the attack is performed remotely through a simple HTTP request [1].
Impact
Successful exploitation results in a denial of service (DoS) due to the system selecting an incorrect configuration file, potentially leading to site unavailability or misbehavior [1]. No data disclosure or code execution is known from this vulnerability alone.
Mitigation
The vulnerability is fixed in Drupal 6.32 and Drupal 7.29, released on July 16, 2014 [1]. Sites running earlier versions should upgrade immediately to these releases. No workaround is available for unpatched versions [1].
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
87cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*+ 86 more
- cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:dev:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.10:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.11:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.12:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.13:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.14:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.15:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.16:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.17:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.18:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.19:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.20:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.21:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.22:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.23:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.24:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.25:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.26:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.27:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.28:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.29:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.30:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.31:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.8:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.9:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha7:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:dev:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.x-dev:*:*:*:*:*:*:*
- (no CPE)range: >= 6.0, < 6.32 || >= 7.0, < 7.29
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.drupal.org/SA-CORE-2014-003nvdPatchVendor Advisory
- www.debian.org/security/2014/dsa-2983nvd
News mentions
0No linked articles in our index yet.