CVE-2026-40481

HIGH

7.5

Beschreibung

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht4/17/2026

Zuletzt geandert4/24/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

monetr:monetr

Schwachen (CWE)

CWE-400

Referenzen

https://github.com/monetr/monetr/releases/tag/v1.12.4(security-advisories@github.com)

https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.