The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to Monoceros 0.30 or later.
Workaround
No workaround given by the vendor.
Mon, 09 Nov 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes. | |
| Title | Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory | |
| Weaknesses | CWE-789 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-10T00:11:03.849Z
Reserved: 2026-10-23T17:37:33.626Z
Link: CVE-2026-115864
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-09T22:18:28.247
Modified: 2026-11-09T22:18:28.247
Link: CVE-2026-115864
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T22:45:08Z