In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation

The primary impact of CVE-2026-40481 is a denial-of-service condition. An attacker can exploit this vulnerability by crafting a malicious POST request with a significantly large body and sending it to the Monetr Stripe webhook endpoint. Because the application buffers the entire request body into memory before signature verification, this can lead to excessive memory consumption. If the server's memory resources are exhausted, it may become unresponsive or crash, effectively denying legitimate users access to the service. The lack of authentication required for accessing the webhook route amplifies the risk, as any external actor can trigger this condition. This vulnerability shares similarities with other memory exhaustion attacks targeting web applications that handle large file uploads or data streams without proper size limitations.

Organizations using monetr versions 1.12.3 and below, particularly those relying on Stripe webhooks for integrations, are at risk. Shared hosting environments where multiple users share the same server resources are especially vulnerable, as a single attacker could impact all users on the host.

• linux / server:

journalctl -u monetr -g "Stripe webhook" | grep -i "memory allocation"

• generic web:

curl -v -X POST -d "$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 100000)" https://your-monetr-instance/stripe-webhook

Inspect the server's memory usage during the curl request. Excessive memory consumption indicates potential exploitation.

1. 2026-04-17Disclosure

   disclosure

1. Reserviert2026-04-13
2. Veröffentlicht2026-04-17
3. Geändert2026-04-20
4. EPSS aktualisiert2026-04-25

The recommended mitigation for CVE-2026-40481 is to immediately upgrade Monetr to version 1.12.4 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to configure a reverse proxy or WAF (Web Application Firewall) to limit the maximum size of POST requests allowed to the Stripe webhook endpoint. Specifically, set a maximum request body size that is significantly smaller than the server's available memory. Additionally, review and potentially adjust the server's memory allocation settings to ensure sufficient resources are available for normal operation. After upgrading, confirm the fix by sending a large POST request to the webhook endpoint and verifying that memory usage remains within acceptable limits.