VulnerabilityAnalyzed

CVE-2026-40481

A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service.

HIGH 8.2EPSS 0.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.

CVSS 4.0: 8.2 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-400
Affected: monetr/monetr
Source: security-advisories@github.com

References

https://github.com/monetr/monetr/releases/tag/v1.12.4Product
https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.