SA-CONTRIB-2026-170: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks. Webform does not sufficiently validate an optional token query value before using it. Under specific configurations where a Webform is rendered for anonymous visitors, a malicious request can cause the request to consume significant resources leading to a Denial of Service.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Which sites are exposed to this denial-of-service condition?
Exposure requires a specific configuration in which a Webform is rendered for anonymous visitors. Sites without anonymously accessible rendered Webforms are not identified as affected by the available information.
What does an attacker need to do to trigger the issue?
An attacker must send a malicious request involving the optional token query value to an anonymously accessible rendered Webform. The issue can cause the request to consume significant resources, resulting in denial of service.
Is authentication required for exploitation?
No. The affected scenario explicitly involves Webforms rendered for anonymous visitors, so an unauthenticated attacker may be able to trigger the resource consumption condition.