PT-2026-33217 · Monetr · Monetr

Published 2026-04-14 · Updated 2026-04-18 · CVE-2026-40481

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions monetr versions prior to 1.12.4

Description The public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. A remote unauthenticated attacker can send oversized POST payloads to the '/api/stripe/webhook' endpoint to cause uncontrolled memory growth, leading to denial of service. This issue occurs because the handler only requires a Stripe-Signature header to be present before buffering the body, meaning memory consumption is controlled by the attacker-supplied payload size even if the signature is invalid. The issue affects deployments where Stripe webhooks are enabled.

Recommendations Update to version 1.12.4. As a temporary mitigation, enforce a request body size limit using an upstream proxy or load balancer to restrict the size of payloads sent to the '/api/stripe/webhook' endpoint.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-40481

GHSA-V7XQ-3WX6-FQC2

Affected Products

Monetr

References · 7

• https://github.com/monetr/monetr/security/advisories/GHSA-v7xq-3wx6-fqc2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40481 · Security Note
• https://osv.dev/vulnerability/GHSA-v7xq-3wx6-fqc2 · Vendor Advisory
• https://github.com/monetr/monetr/releases/tag/v1.12.4 · Note
• https://github.com/monetr/monetr · Note
• https://twitter.com/CVEnew/status/2045467369149981122 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045370678853996631 · Twitter Post