DRUPAL-CONTRIB-2026-170: Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Q: What does an attacker need to exploit this issue?

The attack can be performed over the network without authentication, privileges, or user interaction. The attack complexity is rated low.

Q: Which deployments are realistically exposed?

Drupal Webform installations running an affected version and reachable by an attacker over the network are exposed. The listed impact is limited to availability, with no confidentiality or integrity impact indicated.

Published Oct 22, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack can be performed over the network without authentication, privileges, or user interaction. The attack complexity is rated low.

Which deployments are realistically exposed?

Drupal Webform installations running an affected version and reachable by an attacker over the network are exposed. The listed impact is limited to availability, with no confidentiality or integrity impact indicated.

DRUPAL-CONTRIB-2026-170: Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are realistically exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are realistically exposed?