---
id: "CVE-2026-96365"
kind: "vulnerability"
aliases: ["CVE-2026-96365"]
title: "Drupal Webform: excessive resource allocation lets requests exhaust server memory"
severity: "high"
cvss: 7.5
epss: 0.0046
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted", "webform"]
not_affected_if: ["default-config"]
published_at: "2026-10-22T02:17:06+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:16:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96365", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96365", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Webform: excessive resource allocation lets requests exhaust server memory

Drupal Webform module versions up to 6.2.12 and 6.3.0 through 6.3.1 allocate resources without limits or throttling. An attacker can trigger excessive allocation, which can degrade or take down the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform version with `drush pm:list --filter=webform` or `composer show drupal/webform`
- Confirm whether the installed version falls in the affected ranges listed in the sources

## Fix

- Upgrade the Drupal Webform module to a version newer than `6.2.12` on the 6.2 line, or to `6.3.2` or later on the 6.3 line (unknown if the sources name an exact fixed version)

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96365
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96365

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_