CVE-2026-40481 Details
Description
monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.
A denial-of-service vulnerability has been identified in Monetr, a budgeting application for recurring expenses, in versions through 1.12.3. The issue arises in the public Stripe webhook endpoint, which reads the entire request body into memory before validating the Stripe signature. This flaw allows remote, unauthenticated attackers to send oversized POST payloads, causing uncontrolled memory growth and leading to service unavailability. The vulnerability affects deployments with Stripe webhooks enabled, particularly in the hosted/SaaS configuration. Self-hosted instances are unlikely to be impacted, as the webhook route is disabled by default.
Users can upgrade to Monetr version 1.12.4, which includes a fix for this vulnerability by limiting the request body size in the middleware before it reaches the Stripe webhook handler.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/monetr/monetr/releases/tag/v1.12.4 | [email protected] | Product |
| https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| monetr monetr | < 1.12.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |