CVE-2026-91080
Received Received - Intake

Memory Exhaustion in webhook via Oversized Request Body

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-91080
EUVD
EUVD-2026-77715

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adnanh webhook to 2.8.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91080 is a memory exhaustion vulnerability in the webhook application version 2.8.3. The flaw occurs because the application reads the entire HTTP request body into memory before performing any authentication or trigger rule evaluations. This allows unauthenticated attackers to send oversized request bodies, potentially multi-gigabytes in size, to exhaust server memory and crash the service.

Detection Guidance

Monitor for unusually high memory usage on the webhook service process. Check for large HTTP request bodies in logs or network traffic. Use tools like 'htop' or 'ps' to observe memory consumption spikes. Inspect webhook logs for requests with abnormally large payloads.

Impact Analysis

This vulnerability can cause denial of service by crashing the webhook service, disrupting automated tasks that rely on it. Attackers can exploit it without credentials or specific knowledge of the hook, making it easy to execute. The impact includes service outages, potential data loss, and increased operational overhead to restore functionality.

Compliance Impact

This vulnerability could lead to service disruption or crashes, potentially causing downtime for systems processing sensitive data. For GDPR, this may impact availability of personal data processing systems, risking compliance with Article 32 (security of processing). For HIPAA, it could disrupt systems handling protected health information, violating the Security Rule's integrity and availability requirements.

Mitigation Strategies

Upgrade webhook to a version later than 2.8.3. Implement request size limits in your web server or reverse proxy. Add timeouts for request processing. Restrict access to webhook endpoints via firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart