Live › vulnerability › CVE-2026-96365
Go to dashboardDrupal Webform module versions up to 6.2.12 and 6.3.0 through 6.3.1 allocate resources without limits or throttling. An attacker can trigger excessive allocation, which can degrade or take down the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Webform module in the affected version ranges are exposed. The sources do not say which Webform feature or request path triggers the excessive allocation, so the exact exposure surface is unknown. Sites without the Webform module, or running a version outside those ranges, can skip it.
No product ranges from the sources yet.
drush pm:list --filter=webform or composer show drupal/webform6.2.12 on the 6.2 line, or to 6.3.2 or later on the 6.3 line (unknown if the sources name an exact fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96365")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.