CVE-2026-91080

Published: Sep 14, 2026Modified: Sep 23, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (5)

https://github.com/adnanh/webhook

Source: disclosure@vulncheck.com

https://github.com/adnanh/webhook/blob/2.8.3/webhook.go

Source: disclosure@vulncheck.com

https://github.com/adnanh/webhook/issues/756

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/webhook-through-2.8.3-memory-exhaustion-via-oversized-request-body

Source: disclosure@vulncheck.com

https://github.com/adnanh/webhook/issues/756

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.