PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configur...

Unrated CVE-2026-96365

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:26 LisbonUpdated Mon 26 Oct 2026, 03:25 Lisbon

In plain words

Webform does not sufficiently validate an optional token query value before using it. Under specific configurations where a form is rendered for anonymous visitors, a malicious request can consume significant resources and cause a denial of service.

Am I affected?

Look for drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1, but gives no affected version range. Check whether any Webform is rendered for anonymous visitors; the advisory does not identify the specific configurations required.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks.

Webform does not sufficiently validate an optional token query value before using it. Under specific configurations where a Webform is rendered for anonymous visitors, a malicious request can cause the request to consume significant resources leading to a Denial of Service.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.