CVE-2015-5505: The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drup...

Security readout for executives and security teams

A Drupal HSTS add-on intended to keep browsers on HTTPS may fail to extend that protection to subdomains. If the site relies on subdomain protection, users visiting those subdomains could face man-in-the-middle risk. The public data does not specify the exact impact. Exposure is likely limited to Drupal deployments using the affected contributed HSTS module versions, especially public sites expecting HSTS to cover subdomains. The supplied affected-product metadata is incomplete, but the description names the vulnerable module branches. Treat as a targeted legacy web risk. Prioritize if affected Drupal sites are internet-facing, handle credentials, or rely on subdomains. Otherwise, address during normal vulnerability maintenance with documented validation. Mitigation focus: Upgrade the Drupal HSTS module to 6.x-1.1 or 7.x-1.2 or later.; Check current Drupal advisory guidance before changing production systems.; Review whether subdomains require independent HSTS configuration..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.