CVE-2024-36128

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.

• CWE-754
• CWE-754

• https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3bPatch
• https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5Exploit, Vendor Advisory
• https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3bPatch
• https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5Exploit, Vendor Advisory

Published

Jun 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36120javascript-deobfuscator removes common JavaScript obfuscatio…7.8
• CVE-2024-36121 netty-incubator-codec-ohttp is the OHTTP implementation for…9.1
• CVE-2024-36122Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2024-36123Citizen is a MediaWiki skin that makes extensions part of th…5.4
• CVE-2024-36124iq80 Snappy is a compression/decompression library. When unc…5.3
• CVE-2024-36127apko is an apk-based OCI image builder. apko exposures HTTP …7.5
• CVE-2024-36129The OpenTelemetry Collector offers a vendor-agnostic impleme…7.5
• CVE-2024-3613A vulnerability was found in SourceCodester Warehouse Manage…5.4
• CVE-2024-36130An insufficient authorization vulnerability in web component…9.8
• CVE-2024-36131An insecure deserialization vulnerability in web component o…8.8
• CVE-2024-36132Insufficient verification of authentication controls in EPMM…7.5
• CVE-2024-36136An off-by-one error in WLInfoRailService in Ivanti Avalanche…7.5