CVE-2026-96377

Name of the Vulnerable Software and Affected Versions Combined image style versions 0.0.0 through 1.0.7

Description The module fails to sufficiently validate image style names during the generation of image derivatives. This allows anonymous users to generate image derivatives without a valid token, which can lead to excessive resource allocation and a denial of service. The issue exists regardless of whether combined image styles are configured or in use. This is limited to public files, as derivatives of private files remain protected by the core token check.

Recommendations Update Combined image style to a version later than 1.0.7.