Description

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T18:20:29.760Z",
  "pubdate": "2026-09-14T18:20:29.760Z",
  "executiveSummary": "The webhook application, through version 2.8.3, is susceptible to an unauthenticated Denial of Service (DoS) vulnerability triggered by improper request body handling. The application's architecture mandates the ingestion of the entire incoming HTTP request body into volatile memory prior to the validation of security policies, such as signature verification or trigger rule evaluation.\nThis design flaw permits remote, unauthenticated attackers to transmit maliciously crafted HTTP requests containing oversized payloads. By forcing the server to buffer multi-gigabyte data streams, an attacker can induce rapid memory depletion, ultimately leading to an Out-of-Memory (OOM) condition and application process termination.\nThe vulnerability represents a critical availability risk, as the exploitation requirement is minimal; an attacker only needs network access to the webhook endpoint. Since the crash occurs before any authentication checks are processed, the service is effectively defenseless against resource exhaustion attacks originating from external or internal network segments. No specialized privileges are required to initiate this attack, making it a high-impact threat to service continuity in any environment where the webhook instance is exposed.",
  "technicalDetails": "The root cause of this vulnerability lies in the sequential order of operations within the webhook request processing pipeline. In affected versions through 2.8.3, the application service does not implement streaming request parsing or explicit memory bounds checking on incoming HTTP entities. Instead, the implementation follows a synchronous, monolithic pattern where the complete request body is buffered into the heap memory before the trigger engine attempts to validate the payload against configured rules or signature requirements.\nExploitation is trivial and relies on the attacker's ability to transmit large HTTP POST or PUT requests to the webhook listener. Because the server assumes a 'load-all-then-validate' approach, an attacker can initiate a request with an exceptionally large Content-Length header or stream arbitrary data without terminating the connection. As the data arrives, the process heap grows proportionally to the size of the received bytes. When multiple concurrent requests are initiated, or when a single request exceeds the available physical RAM or container memory limit, the operating system or language runtime triggers an Out-of-Memory (OOM) killer event or throws an unhandled exception, causing the service to crash.\nThe attack flow is as follows: 1) The attacker identifies the publicly reachable endpoint of the webhook service. 2) The attacker crafts an HTTP request, potentially with an invalid HMAC signature, and begins transmitting a massive payload. 3) The webhook service begins reading the input stream into its memory space. 4) The service continues this allocation process regardless of the validity of the signature, as the logic for signature verification is only invoked after the body is fully buffered. 5) Once the memory limit is reached, the application process ceases to function, effectively silencing the service for legitimate users.\nThis vulnerability is strictly related to resource management and request lifecycle handling within the webhook server component. Because the process terminates immediately upon memory exhaustion, it successfully bypasses any application-level access controls or security filters, as these mechanisms are never reached during an oversized payload attack. The exposure is limited to the process availability, but the impact is absolute; legitimate requests are dropped, and the service remains in a crashed or unstable state until manual intervention or a monitoring-based restart occurs. The architecture fails to account for the disparity between incoming data rates and processing capabilities, prioritizing complete payload ingestion over system integrity."
}