Memory Exhaustion Vulnerability in Monoceros for Perl

CVE-2026-115864

What is CVE-2026-115864?

Monoceros versions prior to 0.30 for Perl are vulnerable to a memory exhaustion issue. A remote attacker can craft a request with a large Content-Length value, leading to an out-of-memory error that forcibly kills the worker process. The attack exploits the way request bodies are read in a loop, where Perl attempts to immediately allocate the entire buffer size declared in the Content-Length header. If this size exceeds available system memory, the application fails to handle the request, posing a risk of denial-of-service for users of the affected versions.

References