What’s Vulnerable › Vulnerabilities

CVE-2024-36128: Directus is soft-locked by providing a string value to random string util

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-03 · updated 2026-06-17
• Weakness: CWE-754

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.

Affected products

• directus: before 10.11.2 — fixed in 10.11.2

How to fix

Upgrade to a fixed version: directus 10.11.2. Check the vendor advisory for mitigations.

References

• https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b
• https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5
• https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b
• https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5

Get alerted when CVE-2024-36128 or the next vulnerability affects your stack