CVE-2026-91080: webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker that can reach the webhook service over the network can send oversized request bodies. A valid webhook signature is not required, because the service reads the full body before evaluating trigger rules or rejecting an invalid signature.
What is the practical impact of exploitation?
An attacker can submit multi-gigabyte request bodies to consume available memory and cause an out-of-memory condition. This can crash the webhook service and result in denial of service.
Are deployments protected by webhook trigger rules or signature validation?
No. Trigger rules and signature validation are evaluated only after the complete request body has been read into memory, so they do not prevent memory exhaustion from oversized requests.
What can be done if an update is not immediately available?
Limit request-body sizes before traffic reaches webhook, such as at a reverse proxy or other network-facing request handler. Restrict network access to the service so untrusted clients cannot submit requests directly.