Vulnerability details
CVE-2026-40481
monetr monetr
monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation
CVSS 4.0
8.2High
Official description
monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| monetr | monetr | < 1.12.4 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2 x_refsource_CONFIRM
- https://github.com/monetr/monetr/releases/tag/v1.12.4 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-18
- Last updated
- 2026-04-20
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.44%
Probability of exploitation in 30 days
39%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption