EUVD-2026-107831
GHSA-9762-rjpx-63v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Drupal Webform endpoint
-
ExploitSend request triggering unbounded allocation
-
ExecutionExhaust server memory/CPU resources
-
ImpactDenial of service for users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVE describes unbounded/unthrottled resource allocation (CWE-770) in the Drupal Webform module, but the specific feature, form operation, or protocol that triggers excessive allocation is not described in the available sources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions are claimed - remote unauthenticated requests against default configurations of a Drupal site running a vulnerable Webform version (up to 6.2.12, and 6.3.0 through 6.3.1). Limiting factors: exploitation requires that a Webform-driven endpoint be network-reachable and that the vulnerable module version be installed; impact is confined to availability (service disruption), with no data exposure or code execution. Fixed in Webform 6.2.12 and 6.3.1; per the vendor, updating is the remediation. |
| Impact | This is a network-exploitable, unauthenticated availability-only flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - CWE-770 resource exhaustion causing denial of service, with no confidentiality or integrity impact. The signals are internally consistent but point to moderate rather than top-tier urgency: EPSS is low at 0.19% (8th percentile), there is no CISA KEV listing (not actively exploited per available data), and no confirmed public exploit code. The vendor (Drupal) has shipped a patch and the vuln.today decision label is 'this_week', which aligns with a genuine but non-emergency fix window. The high CVSS is driven entirely by the A:H availability impact combined with the easy remote vector; because the impact is DoS only, the real-world consequence is service disruption rather than compromise. No SSVC decision string (automatable/technical-impact) is provided, so automatability cannot be confirmed. Net: a real priority to patch in the normal cycle, but not a drop-everything emergency - the low EPSS and absence of KEV/working exploit suggest no widespread exploitation at this time. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to a Drupal site running a vulnerable Webform module, abusing an operation that allocates resources without limits or throttling to exhaust memory or processing capacity. Sustained requests degrade or crash the service, causing denial of service for legitimate users. No public working exploit code is identified at time of analysis; the specific triggering operation is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Unauthenticated resource exhaustion in the Drupal Webform contrib module (all versions from 0.0.0 through 6.2.12, plus 6.3.0 through 6.3.1) lets remote attackers drive excessive resource allocation and degrade or deny availability of a Drupal site; confidentiality and integrity are unaffected (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is CWE-770 (allocation without limits or throttling), and the vendor's stated remediation is to update the module per Drupal security advisory sa-contrib-2026-170. Risk signals are moderate rather than urgent: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis, though the priority label places remediation in the current week.
RemediationAI
The vendor states that updating is the remediation, with the fix published through Drupal security advisory sa-contrib-2026-170 (https://www.drupal.org/sa-contrib-2026-170); our data records the fixed releases as Webform 6.2.12 and 6.3.1, but since those same version numbers also fall inside the reported affected ranges, verify the exact fixed release for your branch on the advisory page before deploying and upgrade to the first release above the affected range on the branch you run (the 6.2.x line or the 6.3.x line). There is no vendor-published workaround identified in the available data, and no patched-version substitute exists for the module itself. Because the assessed impact is availability-only and exploitation requires a Webform-driven endpoint to be network-reachable, restricting external reachability to Webform submission endpoints (for example placing the Drupal site behind an access-controlled proxy or limiting exposure during a maintenance window) is a stopgap that reduces exposure until the update is applied; the trade-off is that legitimate anonymous and authenticated form submissions from restricted networks will also be blocked, so this should be treated as temporary. Monitor for repeated or oversized requests against Webform routes as a detection signal, and note that EPSS is low (0.19%) and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Webform contributed module for Drupal, identified by CPE cpe:2.3:a:drupal:webform:*:*:*:*:*:*:*:*. The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling: the module permits an operation to consume resources without an effective cap or rate constraint, so repeated or oversized requests can exhaust memory, worker processes, or request-handling capacity on the Drupal host and produce a denial-of-service condition. The scored vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity path with no privileges or user interaction required and impact limited to availability within the Drupal application scope. Notably, the specific Webform feature, form operation, or request pattern that triggers the unbounded allocation is not described in the available sources, so the precise mechanism cannot be attributed from the supplied evidence; what is confirmed is the resource-exhaustion class, the availability-only impact, and that exploitation requires the vulnerable module to be installed and a Webform-driven endpoint to be reachable over the network.
Know when Webform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated resource-exhaustion DoS reachable over the network with low complexity (AV:N/AC:L/PR:N/UI:N); availability-only impact (A:H), no confidentiality or integrity effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Executive ViewAI
The Drupal Webform module, used across many enterprise Drupal sites for form handling, contains an unauthenticated resource exhaustion flaw that can degrade or deny availability of the entire site. While confidentiality and integrity are unaffected, a successful attack could disrupt online services and damage customer trust. Leadership should prioritize remediation given the module's widespread use and the availability impact.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB