CVE-2026-40481

HighPublic PoC

Published: 17 April 2026

Published

17 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0027 50.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40481 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Monetr Monetr. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked in the top 49.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-7 (Boundary Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application Exhaustion Flood (T1499.003). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-5 Denial-of-service Protection good match

prevent

Directly protects against denial-of-service events like uncontrolled memory growth from oversized POST payloads to the public Stripe webhook endpoint.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of the specific flaw buffering entire request bodies before signature validation, as addressed in monetr version 1.12.4.

SC-7 Boundary Protection good match

prevent

Implements boundary protections via upstream proxies to enforce request body size limits, blocking oversized payloads from reaching the vulnerable endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.

attack.mitre.org →

Why these techniques?

Vulnerability enables sending oversized POST payloads to public webhook endpoint, directly facilitating application exhaustion flood (memory consumption) for denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to…

cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.

Deeper analysisAI

CVE-2026-40481 is a denial-of-service vulnerability in the monetr budgeting application for recurring expenses, affecting versions 1.12.3 and prior. The public Stripe webhook endpoint buffers the entire incoming request body into memory before validating the Stripe signature, allowing oversized POST payloads to trigger uncontrolled memory growth. This issue, classified under CWE-400 (Uncontrolled Resource Consumption), carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and impacts deployments where Stripe webhooks are enabled.

A remote unauthenticated attacker can exploit this vulnerability by sending maliciously large POST requests to the webhook endpoint, exhausting server memory and causing service disruption. No privileges, user interaction, or special conditions are required beyond network access to the endpoint, making it straightforward for attackers to repeatedly trigger resource exhaustion and render the application unavailable.

The monetr security advisory (GHSA-v7xq-3wx6-fqc2) and release notes for version 1.12.4 confirm the issue has been addressed in that update. Deployments can also mitigate the risk by configuring an upstream proxy to enforce request body size limits, preventing oversized payloads from reaching the application.