Live › vulnerability › CVE-2026-96377
Go to dashboardThe Drupal Combined image style module allocates resources without limits or throttling, so crafted requests can consume excessive memory or processing. An attacker can slow or crash the site by exhausting its resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Drupal with the Combined image style module at version 1.0.7 or earlier. The sources do not say which configurations expose the flaw, so whether a public-facing image style route is required is unknown. Sites without this module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=combined_image_style or the Extend page) and see whether it is 1.0.7 or older.1.0.7 once the sources name the fixed release (unknown in the sources provided).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-96377")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.