{"id":"CVE-2026-96377","kind":"vulnerability","aliases":["CVE-2026-96377"],"related":[],"title":"Drupal Combined Image Style module: excessive resource allocation enables denial of service","description":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.","summary":"The Drupal Combined image style module allocates resources without limits or throttling, so crafted requests can consume excessive memory or processing. An attacker can slow or crash the site by exhausting its resources.","severity":"medium","cvss":5.3,"epss":0.00238,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal Combined image style module (`drush pm:list --filter=combined_image_style` or the Extend page) and see whether it is `1.0.7` or older.","fix":"- Update the Combined image style module to a version newer than `1.0.7` once the sources name the fixed release (unknown in the sources provided).","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:35+00:00","updated_at":"2026-10-25T04:20:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Combined image style module to a version newer than `1.0.7` once the sources name the fixed release (unknown in the sources provided).","reach":"unknown","title":"Drupal Combined Image Style module: excessive resource allocation enables denial of service","impact":"low","summary":"The Drupal Combined image style module allocates resources without limits or throttling, so crafted requests can consume excessive memory or processing. An attacker can slow or crash the site by exhausting its resources.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Site resource exhaustion causes slowdown or denial of service","analyst_note":"Confirm the fixed version and whether unauthenticated requests reach the image style route, using the NVD entry and the Drupal security advisory.","how_to_check":"- Check the installed version of the Drupal Combined image style module (`drush pm:list --filter=combined_image_style` or the Extend page) and see whether it is `1.0.7` or older.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running Drupal with the Combined image style module at version 1.0.7 or earlier. The sources do not say which configurations expose the flaw, so whether a public-facing image style route is required is unknown. Sites without this module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":3333,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-96377':15A,18A '0.0.0':82C '1.0.7':84C 'affect':76C 'alloc':8A,31B,58C,73C 'allow':71C 'attack':47B 'combin':2A,27B,68C,77C 'consum':41B 'craft':38B 'crash':51B 'cve':13A,16A 'denial':10A 'drupal':1A,19B,26B,67C 'enabl':9A 'excess':6A,42B,72C 'exhaust':55B 'host':24B 'imag':3A,28B,69C,78C 'issu':75C 'limit':34B,62C 'memori':43B 'modul':5A,30B 'packag':20B 'php':21B 'process':45B 'request':39B 'resourc':7A,32B,57B,60C 'self':23B 'self-host':22B 'servic':12A 'site':53B 'slow':49B 'style':4A,29B,70C,79C 'throttl':36B,64C 'version':80C 'vulner':65C 'without':33B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Combined image style module at version 1.0.7 or earlier. The sources do not say which configurations expose the flaw, so whether a public-facing image style route is required is unknown. Sites without this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96377","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96377","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96377","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}