{"id":"CVE-2026-107312","kind":"vulnerability","aliases":["CVE-2026-107312"],"related":[],"title":"Drupal Examples for Developers: resource allocation flaw allows excessive memory use","description":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.","summary":"Drupal Examples for Developers, a set of sample modules for Drupal, has an allocation flaw that lets excessive resources be allocated. The sources do not state what an attacker gets beyond resource exhaustion.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Examples for Developers module (Drupal project `examples`) against the affected range","fix":null,"status":"open","published_at":"2026-10-30T04:17:59+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:21+00:00","updated_at":"2026-10-30T04:31:21+00:00","category":"package","confidence":0.3,"triage":{"at":"2026-10-30T04:31:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Drupal Examples for Developers: resource allocation flaw allows excessive memory use","impact":"low","summary":"Drupal Examples for Developers, a set of sample modules for Drupal, has an allocation flaw that lets excessive resources be allocated. The sources do not state what an attacker gets beyond resource exhaustion.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","php"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; resource exhaustion likely, beyond that not stated","analyst_note":"Confirm the attack path, required configuration and any fixed version from the NVD entry and the Drupal security advisory.","how_to_check":"- Check the installed version of the Examples for Developers module (Drupal project `examples`) against the affected range\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites that have the Examples for Developers module installed, which the sources list as affected in versions from 0.0.0 to 4.0.7. The sources do not say whether the module must be enabled or reachable to be exploited.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000643,"input_tokens":4095,"output_tokens":467,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107312':14A,17A '-2026':13A,16A '0.0.0':78C '4.0.7':80C 'affect':72C 'alloc':6A,34B,41B,54C,69C 'allow':8A,67C 'attack':49B 'beyond':51B 'cve':12A,15A 'develop':4A,24B,66C,75C 'drupal':1A,18B,21B,31B,63C 'exampl':2A,22B,64C,73C 'excess':9A,38B,68C 'exhaust':53B 'flaw':7A,35B 'get':50B 'issu':71C 'let':37B 'limit':58C 'memori':10A 'modul':29B 'packag':19B 'php':20B 'resourc':5A,39B,52B,56C 'sampl':28B 'set':26B 'sourc':43B 'state':46B 'throttl':60C 'use':11A 'version':76C 'vulner':61C 'without':57C","nicknames":[],"mitigations":[],"who_affected":"Sites that have the Examples for Developers module installed, which the sources list as affected in versions from 0.0.0 to 4.0.7. The sources do not say whether the module must be enabled or reachable to be exploited.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:17:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107312","severity":null,"published_at":"2026-10-30T04:17:59+00:00","modified_at":"2026-10-30T04:17:59+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}