CVE-2026-96365 Drupal CVE debrief

Who should care

Defenders managing Drupal installations with the Webform module should assess their exposure and take necessary actions to prevent potential denial of service attacks.

Why it matters

CVE-2026-96365 is a denial of service vulnerability in Drupal Webform due to Allocation of Resources Without Limits or Throttling. Defenders should verify exposure, especially for versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1, and assess potential impacts on service availability.

• Potential denial of service due to excessive resource allocation.
• Need for verification of Webform versions and exposure.
• Possible impact on service availability if exploited.
• Requirement for monitoring and potential upgrades.

Technical summary

The Drupal Webform module is vulnerable to an Allocation of Resources Without Limits or Throttling issue, which can lead to a denial of service. This vulnerability affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The issue arises from the module's inability to limit or throttle resource allocation, allowing for excessive allocation that can cause service unavailability. Defenders should prioritize verifying exposure in their Webform installations, especially if versions 0.0.0 to 6.2.12 or 6.3.0 to 6.3.1 are in use, and assess the potential

Defensive priority

Defenders should prioritize verifying exposure in their Webform installations, especially if versions 0.0.0 to 6.2.12 or 6.3.0 to 6.3.1 are in use, and assess the potential for denial of service attacks.

Recommended defensive actions

• Verify Webform version and check if it falls within affected ranges.
• Review and limit resource allocation for Webform to prevent excessive allocation.
• Implement monitoring to detect potential denial of service attempts.
• Consider upgrading to a version outside the affected ranges if possible.

Evidence notes

The CVE record and source item provide details on the vulnerability in Drupal Webform, including affected versions and a reference to the Drupal security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.