---
id: "CVE-2026-96377"
kind: "vulnerability"
aliases: ["CVE-2026-96377"]
title: "Drupal Combined Image Style module: excessive resource allocation enables denial of service"
severity: "medium"
cvss: 5.3
epss: 0.00238
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:08+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96377", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96377", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Combined Image Style module: excessive resource allocation enables denial of service

The Drupal Combined image style module allocates resources without limits or throttling, so crafted requests can consume excessive memory or processing. An attacker can slow or crash the site by exhausting its resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Drupal Combined image style module (`drush pm:list --filter=combined_image_style` or the Extend page) and see whether it is `1.0.7` or older.

## Fix

- Update the Combined image style module to a version newer than `1.0.7` once the sources name the fixed release (unknown in the sources provided).

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96377
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96377

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_