CVE-2026-91080

webhook, an open-source tool for receiving HTTP webhooks and executing configured commands, buffers the entire HTTP request body into memory before evaluating its trigger rules in all versions through 2.8.3. An unauthenticated attacker can exploit this by sending multi-gigabyte request bodies—even ones with invalid signatures, which are still fully read before rejection—causing out-of-memory conditions that crash or destabilize the service. The impact is availability-only: the attacker gains no confidentiality or compromise of the host, but can repeatedly deny service to automation and CI/CD pipelines that depend on the webhook receiver. Any deployment of webhook up to and including 2.8.3 that is reachable by untrusted network traffic is affected. The flaw is not in CISA's KEV, no public proof of concept is known, and no exploitation in the wild has been reported.

What to do: Upgrade webhook to a release newer than 2.8.3 as soon as a fixed version is available. If you cannot upgrade immediately, place webhook behind a reverse proxy that enforces a strict request body size limit (e.g., nginx client_max_body_size set to the largest legitimate payload your hooks need) and add rate limiting. Check logs and container/system metrics for OOM kills or unexplained restarts, and restrict network access so only expected webhook sources (e.g., GitHub, GitLab IPs) can reach the listener.