Description
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Published: 2026-10-22
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability involves uncontrolled allocation of system resources in Drupal Webform. An attacker can submit crafted input that forces the module to consume memory or CPU without limits, eventually exhausting the host and causing a denial of service. The weakness corresponds to CWE-770, Excessive Allocation.

Affected Systems

Affected are Drupal Webform releases from 0.0.0 through 6.2.12 and from 6.3.0 through 6.3.1. All installations running these bundled versions are at risk until an updated version is applied.

Risk and Exploitability

Because the issue can be triggered through normal form submission, the attack vector is remote over HTTP. EPSS score is < 1% and the CVSS score is 7.5, but the denial of service impact can affect all users on the same host. The vulnerability is not included in the CISA KEV catalog, indicating no publicly known exploits, yet any publicly exposed form could be abused. Administrators should treat this as a moderate to high risk until a patch is applied.

Generated by OpenCVE AI on October 22, 2026 at 16:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Webform release that contains the fix (e.g., upgrade to the most recent major version).
  • Implement rate limiting, CAPTCHAs, or other submission controls on affected forms to reduce the volume of requests that could trigger resource exhaustion.
  • Configure web server or container limits on memory, process count, and CPU to contain the impact of any exploitation attempt.

Generated by OpenCVE AI on October 22, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.drupal.org/sa-contrib-2026-170 cve-icon cve-icon
History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal webform
Vendors & Products Drupal
Drupal webform

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Title Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
Weaknesses CWE-770
References

Subscriptions

Drupal Webform
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-10-22T14:58:52.996Z

Reserved: 2026-09-23T01:32:48.995Z

Link: CVE-2026-96365

cve-icon Vulnrichment

Updated: 2026-10-22T14:58:45.493Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:06.630

Modified: 2026-10-22T16:54:17.390

Link: CVE-2026-96365

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:45:09Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling