Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck
CVE-2026-91080webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
High 7.5
In plain English
A high-severity resource allocation without limits in webhook from adnanh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Issue #756 issue-tracking
- https://github.com/adnanh/webhook product
- webhook.go at 2.8.3 technical-description
- VulnCheck Advisory: webhook through 2.8.3 Memory Exhaustion via Oversized Request Body third-party-advisory