Examples for Developers CVE-2026-107312

Exploitation requires that the optional 'Examples for Developers' contrib module (version below 4.0.7) be installed and enabled - this is the primary limiting factor, since the module is a developer-oriented demonstration package not typically present on production Drupal sites. The CVSS vector's PR:L indicates a valid low-privileged authenticated account is also needed; the exact feature, route, or configuration that performs the unthrottled allocation is not described in the available sources. Impact is confined to availability (service degradation/DoS); there is no confidentiality or integrity effect.

This is a low-to-moderate priority issue that the raw CVSS 4.3 (Medium) score already frames correctly, and the multi-source signals reinforce rather than elevate that reading. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates a network-reachable, low-complexity attack requiring some level of authentication (PR:L), with impact limited to partial availability degradation (A:L) and no confidentiality or integrity effect - consistent with the CWE-770 excessive-allocation / denial-of-service nature. The EPSS score is very low (0.15%, 4th percentile), and SSVC concurs: exploitation 'none', automatable 'no', technical impact 'partial'. There is no CISA KEV listing and no public exploit identified. The vuln.today decision label is 'this_month', which is a routine-patching cadence, not an urgent one. The one tension worth flagging is that the affected component - Drupal's 'Examples for Developers' - is a demonstration/learning module not intended for production deployment, which likely means the real-world attack surface is far smaller than a network-vector DoS would otherwise suggest; verify whether the module is even enabled before prioritizing. Net: a legitimate but low-urgency bug suitable for scheduled patching.

An attacker holding a low-privileged authenticated account on a Drupal site that has the Examples for Developers module enabled sends crafted requests to an endpoint that allocates resources without throttling, driving excessive memory or processing consumption. Sustained requests degrade site availability for other users. No public exploit code has been identified, and impact is limited to availability (no data exposure).