Threats affecting pkg:composer/drupal/http_client_manager

CVE-2025-14840 is a high-severity vulnerability in the Drupal HTTP Client Manager affecting versions prior to 9.3.13, 10.0.2, and 11.0.1. It stems from an improper check for unusual or exceptional conditions (CWE-754), enabling forceful browsing attacks. The vulnerability allows unauthenticated, remote attackers to cause a denial of service by exploiting the HTTP Client Manager's failure to handle exceptional conditions properly. There are no known exploits in the wild yet.