HIGH

CVE-2026-91080

2026-09-14 CVSS v3.1

CVSS

7.5

Description

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.59%

Probability of exploitation in next 30 days

47th percentile

References

https://github.com/adnanh/webhook https://github.com/adnanh/webhook/blob/2.8.3/webhook.go https://github.com/adnanh/webhook/issues/756 https://www.vulncheck.com/advisories/webhook-through-2.8.3-memory-exhaustion-via-oversized-request-body

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE