{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"Monoceros","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"0.30","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-115864","cwes":["CWE-789"],"description":"Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794258988102,"publishedAt":1794258988102,"references":[{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/kazeburo/Monoceros/commit/897a4a9624329fc0a4b2352d387bdac6d37848e2.patch"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/KAZEBURO/Monoceros-0.30/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to Monoceros 0.30 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/kazeburo/Monoceros/commit/897a4a9624329fc0a4b2352d387bdac6d37848e2.patch"}],"revision":"90e8f97b2a4fefe116690bb617e2a03345f7b433710a4bdcaf808cf8b518031a","sources":[{"modifiedAt":1794258988102,"name":"CNA: CPANSec","retrievedAt":1794262139548,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115864"}],"ssvc":null,"status":"published","title":"Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory","updatedAt":1794262139548}