CVE-2026-91080CWE-770denial-of-service

CVE-2026-91080

High · published September 14, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00658 · 50.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-14T22:20Z
References (5)
https://github.com/adnanh/webhook · [email protected]https://github.com/adnanh/webhook/blob/2.8.3/webhook.go · [email protected]https://github.com/adnanh/webhook/issues/756 · [email protected]https://www.vulncheck.com/advisories/webhook-through-2.8.3-memory-exhaustion-via-oversized-request-body · [email protected]https://github.com/adnanh/webhook/issues/756 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 14 SEP 17:52Z
    webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
    cvelistv5