DRUPAL-CONTRIB-2026-188: Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
Published Oct 22, 2026
·Updated
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.
Affected Software
1 affected component
Drupal Combined image style>=0.0.0<=1.0.7
Event History
Oct 22, 2026
CVE Published
via OSV·01:21 AM
Data Sourced
via OSV·01:21 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Drupal Combined image style versions from 0.0.0 through 1.0.7 are affected.
2
Can this be exploited remotely without authentication?
Yes. The supplied CVSS vector identifies network attack access, low attack complexity, no required privileges, and no user interaction.
3
What is the likely security impact?
The issue permits excessive resource allocation, which can affect availability. The provided CVSS vector indicates no confidentiality or integrity impact and low availability impact.