Webhook
Monthly
Memory exhaustion in adnanh/webhook through 2.8.3 allows unauthenticated remote attackers to crash the service by streaming multi-gigabyte HTTP request bodies at any configured hook endpoint. The daemon reads the entire request body into memory before it evaluates trigger rules or validates the payload signature, so invalid or unsigned requests are just as effective as valid ones at forcing an out-of-memory kill. SSVC rates the issue as automatable and already exploited by proof-of-concept code, though there is no CISA KEV listing and no vendor-issued fix version identified in the available references.
Memory exhaustion in adnanh/webhook through 2.8.3 allows unauthenticated remote attackers to crash the service by streaming multi-gigabyte HTTP request bodies at any configured hook endpoint. The daemon reads the entire request body into memory before it evaluates trigger rules or validates the payload signature, so invalid or unsigned requests are just as effective as valid ones at forcing an out-of-memory kill. SSVC rates the issue as automatable and already exploited by proof-of-concept code, though there is no CISA KEV listing and no vendor-issued fix version identified in the available references.