Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M
CVE-2026-40481monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation
High 8.2
In plain English
A high-severity uncontrolled resource consumption in monetr from monetr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
monetr is a budgeting application for recurring expenses. In versions 1.12.3 and below, the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to cause uncontrolled memory growth, leading to denial of service. The issue affects deployments with Stripe webhooks enabled and is mitigated if an upstream proxy enforces a request body size limit. This issue has been fixed in version 1.12.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/monetr/monetr | 1.12.4 | GHSA-v7xq-3wx6-fqc2 |
| Go | github.com/monetr/monetr | 1.12.4 | GO-2026-5654 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2 x_refsource_CONFIRM
- https://github.com/monetr/monetr/releases/tag/v1.12.4 x_refsource_MISC