Memory Exploitation Vulnerability in Monetr Budgeting Application
CVE-2026-40481

8.2HIGH

Key Information:

Vendor

Monetr

Status
Monetr
Vendor
CVE Published:
17 April 2026

What is CVE-2026-40481?

The Monetr budgeting application has a vulnerability present in versions 1.12.3 and earlier, where the public Stripe webhook endpoint excessively buffers the entire request body into memory prior to validating the Stripe signature. This flaw allows a remote unauthenticated attacker to send oversized POST payloads, which can trigger uncontrolled memory growth and ultimately lead to a denial of service. This vulnerability particularly affects installations with Stripe webhooks enabled. An effective mitigation is implemented by utilizing an upstream proxy that enforces a limit on request body sizes. The issue has been addressed in version 1.12.4.

Affected Version(s)

monetr < 1.12.4

References

https://github.com/monetr/monetr/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/monetr/monetr/releases/tag/v1.12.4
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.