Description
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| adnanh | webhook | ≤ 2.8.3 | — |
References
- GitHub Issue #756 issue-tracking
- https://github.com/adnanh/webhook product
- webhook.go at 2.8.3 technical-description
- VulnCheck Advisory: webhook through 2.8.3 Memory Exhaustion via Oversized Request Body third-party-advisory