Only the latest stable release is actively maintained.
Report vulnerabilities through the Drupal Security Team: https://www.drupal.org/drupal-security-team
Please avoid public issue details until the vulnerability has been triaged and a fix is available.
| Severity | Target patch release |
|---|---|
| Critical | 72 hours |
| High | 7 days |
| Medium | 30 days |
| Low | 90 days |
Dependencies are reviewed against Drupal.org security advisories on each release. Security fixes may be released outside the regular feature cadence.