CVE-2026-91080

HIGH 7.5

webhook through 2.8.3 Memory Exhaustion via Oversized Request Body

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

CWE	CWE-770
Vendor	adnanh
Product	webhook
Published	Sep 14, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for adnanh webhook

Be the first to know when new high vulnerabilities affecting adnanh webhook are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

adnanh / webhook

0 ≤ 2.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/adnanh/webhook/issues/756 github.com: https://github.com/adnanh/webhook github.com: https://github.com/adnanh/webhook/blob/2.8.3/webhook.go vulncheck.com: https://www.vulncheck.com/advisories/webhook-through-2.8.3-memory-exhaustion-via-oversized-request-body

Credits

🔍 George Chen