AIKIDO-2026-391597
drupal/examples is vulnerable to Allocation of Resources Without Limits or Throttling
32
Low Risk
This Affects:
drupal/examplesTL;DR
The email_example submodule in Examples for Developers exposes a form at /examples/email-example that requires only the access content permission. Submitting the form sends the visitor's message to any address they supply, using the site email address as the sender, and the form does not limit how many messages can be sent. A visitor can use that form to send illegitimate email through the site and consume mail resources. Examples for Developers 4.0.7 removes the email_example submodule.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and have the email_example submodule enabled.
Background info
drupal/examples is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.1 - 4.0.6.
How to fix this
Uninstall the email_example submodule, then upgrade the drupal/examples module to the patch version. Developers who copied this example into custom code should review that code.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.