{"cve":"CVE-2026-40481","nvd":{"published":"2026-04-17T23:16:12.457","modified":"2026-06-17T10:45:21.390","status":"Analyzed","description":"monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/monetr/monetr/releases/tag/v1.12.4","https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2"],"products":["monetr:monetr"],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2026-40481","score":0.00447,"percentile":0.38887,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v7xq-3wx6-fqc2","url":"https://osv.dev/vulnerability/GHSA-v7xq-3wx6-fqc2","summary":"In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation","modified":"2026-06-25T23:11:38.186544045Z","packages":[{"ecosystem":"Go","name":"github.com/monetr/monetr","purl":"pkg:golang/github.com/monetr/monetr","ranges":["<1.12.4"],"fixed":["1.12.4"]}]},{"id":"GO-2026-5654","url":"https://osv.dev/vulnerability/GO-2026-5654","summary":"In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation in github.com/monetr/monetr","modified":"2026-06-25T23:01:38.529262305Z","packages":[{"ecosystem":"Go","name":"github.com/monetr/monetr","purl":"pkg:golang/github.com/monetr/monetr","ranges":["<1.12.4"],"fixed":["1.12.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}