Drupal 11.x — End of Life
EOL soon Actively exploited EOL: Jul 7, 2027in 257d5 releases in this series13 CVEs
Drupal 11.x is partially supported: only 11.4, 11.3 still receive security fixes, the longest-lived (11.4) until Jul 7, 2027, in 257 days. The most recent release in this series is 11.4.11. 13 CVEs are tracked for this series, including 1 critical and 1 actively exploited according to CISA KEV. 12 of them were published after the end of life of the affected cycle and will not get an official patch.
Drupal 11.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 11.4 | Jul 1, 2026 | Jan 1, 2027 | Jul 7, 2027 | 11.4.11 | Active | |
| 11.3 | Dec 17, 2025 | Jun 16, 2026 | Dec 16, 2026 | 11.3.20 | EOL soon | |
| 11.2 | Jun 18, 2025 | Dec 10, 2025 | Jul 1, 2026 | 11.2.14 | EOL | |
| 11.1 | Dec 16, 2024 | Jun 18, 2025 | Dec 10, 2025 | 11.1.10 | EOL | |
| 11.0 | Aug 2, 2024 | Dec 16, 2024 | Jun 16, 2025 | 11.0.13 | EOL |
CVEs affecting Drupal 11.x (45)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55808 | MEDIUM | 5.4 | 0.27% | — | 11.1 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | Jul 10, 2026 |
| CVE-2026-55808 | MEDIUM | 5.4 | 0.27% | — | 11.0 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | Jul 10, 2026 |
| CVE-2026-55808 | MEDIUM | 5.4 | 0.27% | — | 11.2 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | Jul 10, 2026 |
| CVE-2026-55808 | MEDIUM | 5.4 | 0.27% | — | 11.3 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | Jul 10, 2026 |
| CVE-2026-55807 | LOW | 3.1 | 0.22% | — | 11.3 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue af… | Jul 10, 2026 |
| CVE-2026-55807 | LOW | 3.1 | 0.22% | — | 11.1 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue af… | Jul 10, 2026 |
| CVE-2026-55807 | LOW | 3.1 | 0.22% | — | 11.0 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue af… | Jul 10, 2026 |
| CVE-2026-55807 | LOW | 3.1 | 0.22% | — | 11.2 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue af… | Jul 10, 2026 |
| CVE-2026-55806 | MEDIUM | 5.9 | 0.33% | — | 11.1 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is… | Jul 10, 2026 |
| CVE-2026-55806 | MEDIUM | 5.9 | 0.33% | — | 11.2 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is… | Jul 10, 2026 |
| CVE-2026-55806 | MEDIUM | 5.9 | 0.33% | — | 11.3 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is… | Jul 10, 2026 |
| CVE-2026-55806 | MEDIUM | 5.9 | 0.33% | — | 11.0 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is… | Jul 10, 2026 |
| CVE-2026-55804 | MEDIUM | 5.9 | 0.35% | — | 11.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55804 | MEDIUM | 5.9 | 0.35% | — | 11.3 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55804 | MEDIUM | 5.9 | 0.35% | — | 11.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55804 | MEDIUM | 5.9 | 0.35% | — | 11.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55803 | MEDIUM | 5.9 | 0.35% | — | 11.3 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55803 | MEDIUM | 5.9 | 0.35% | — | 11.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55803 | MEDIUM | 5.9 | 0.35% | — | 11.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-55803 | MEDIUM | 5.9 | 0.35% | — | 11.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Jul 10, 2026 |
| CVE-2026-9082 | CRITICAL | 9.8 | 15.70% | KEV | 11.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core… | May 20, 2026 |
| CVE-2026-9082 | CRITICAL | 9.8 | 15.70% | KEV | 11.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core… | May 20, 2026 |
| CVE-2026-9082 | CRITICAL | 9.8 | 15.70% | KEV | 11.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core… | May 20, 2026 |
| CVE-2026-9082 | CRITICAL | 9.8 | 15.70% | KEV | 11.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core… | May 20, 2026 |
| CVE-2026-6367 | MEDIUM | 6.1 | 0.25% | — | 11.3 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | May 19, 2026 |
| CVE-2026-6366 | MEDIUM | 6.6 | 0.41% | — | 11.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | May 19, 2026 |
| CVE-2026-6366 | MEDIUM | 6.6 | 0.41% | — | 11.3 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | May 19, 2026 |
| CVE-2026-6366 | MEDIUM | 6.6 | 0.41% | — | 11.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | May 19, 2026 |
| CVE-2026-6366 | MEDIUM | 6.6 | 0.41% | — | 11.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | May 19, 2026 |
| CVE-2026-6365 | MEDIUM | 6.1 | 0.29% | — | 11.0 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | May 19, 2026 |
| CVE-2026-6365 | MEDIUM | 6.1 | 0.29% | — | 11.2 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | May 19, 2026 |
| CVE-2026-6365 | MEDIUM | 6.1 | 0.29% | — | 11.3 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | May 19, 2026 |
| CVE-2026-6365 | MEDIUM | 6.1 | 0.29% | — | 11.1 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core… | May 19, 2026 |
| CVE-2025-13083 | LOW | 3.7 | — | — | 11.0 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrec… | Nov 18, 2025 |
| CVE-2025-13083 | LOW | 3.7 | — | — | 11.1 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrec… | Nov 18, 2025 |
| CVE-2025-13083 | LOW | 3.7 | — | — | 11.2 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrec… | Nov 18, 2025 |
| CVE-2025-13082 | MEDIUM | 4.3 | — | — | 11.1 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofin… | Nov 18, 2025 |
| CVE-2025-13082 | MEDIUM | 4.3 | — | — | 11.0 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofin… | Nov 18, 2025 |
| CVE-2025-13082 | MEDIUM | 4.3 | — | — | 11.2 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofin… | Nov 18, 2025 |
| CVE-2025-13081 | MEDIUM | 5.9 | — | — | 11.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Nov 18, 2025 |
| CVE-2025-13081 | MEDIUM | 5.9 | — | — | 11.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Nov 18, 2025 |
| CVE-2025-13081 | MEDIUM | 5.9 | — | — | 11.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow… | Nov 18, 2025 |
| CVE-2025-13080 | MEDIUM | 5.3 | — | — | 11.1 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This i… | Nov 18, 2025 |
| CVE-2025-13080 | MEDIUM | 5.3 | — | — | 11.2 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This i… | Nov 18, 2025 |
| CVE-2025-13080 | MEDIUM | 5.3 | — | — | 11.0 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This i… | Nov 18, 2025 |
Add a Drupal 11 EOL badge to your README
Show your users which Drupal version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/drupal/11)Frequently asked questions
Is Drupal 11 end of life?
Partially. 3 of the 5 Drupal 11.x releases have reached end of life. Still supported: 11.4, 11.3 (until July 7, 2027 at the latest).
What CVEs affect Drupal 11?
There are 13 CVEs tracked for Drupal 11.x, including 1 critical severity issue and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Drupal 11 version?
The latest Drupal 11.x patch release is 11.4.11, released on October 21, 2026. Always run the latest patch to benefit from all security fixes.
When was Drupal 11 first released?
Drupal 11.0 was released on August 2, 2024. See the full version timeline in the table above.
Is it safe to run Drupal 11 in production?
Only on a supported release (11.4, 11.3). Support for Drupal 11.4 ends on July 7, 2027. Make sure you run the latest patch (11.4.11) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA