CVE-2026-40481
Published: 17 April 2026
Summary
CVE-2026-40481 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Monetr Monetr. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-40481 is a denial-of-service vulnerability in the monetr budgeting application for recurring expenses, affecting versions 1.12.3 and prior. The public Stripe webhook endpoint buffers the entire incoming request body into memory before validating the Stripe signature, allowing oversized POST payloads to trigger uncontrolled memory growth. This issue, classified under CWE-400 (Uncontrolled Resource Consumption), carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and impacts deployments where Stripe webhooks are enabled.
A remote unauthenticated attacker can exploit this vulnerability by sending maliciously large POST requests to the webhook endpoint, exhausting server memory and causing service disruption. No privileges, user interaction, or special conditions are required beyond network access to the endpoint, making it straightforward for attackers to repeatedly trigger resource exhaustion and render the application unavailable.
The monetr security advisory (GHSA-v7xq-3wx6-fqc2) and release notes for version 1.12.4 confirm the issue has been addressed in that update. Deployments can also mitigate the risk by configuring an upstream proxy to enforce request body size limits, preventing oversized payloads from reaching the application.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23591
Vulnerability details
monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to…
more
cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables sending oversized POST payloads to public webhook endpoint, directly facilitating application exhaustion flood (memory consumption) for denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly protects against denial-of-service events like uncontrolled memory growth from oversized POST payloads to the public Stripe webhook endpoint.
Requires timely remediation of the specific flaw buffering entire request bodies before signature validation, as addressed in monetr version 1.12.4.
Implements boundary protections via upstream proxies to enforce request body size limits, blocking oversized payloads from reaching the vulnerable endpoint.