The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
Upgrade to Monoceros 0.30 or later.
Workaround
No workaround given by the vendor.
Tue, 10 Nov 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 09 Nov 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes. | |
| Title | Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory | |
| Weaknesses | CWE-789 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-10T00:11:03.849Z
Reserved: 2026-10-23T17:37:33.626Z
Link: CVE-2026-115864
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-09T22:18:28.247
Modified: 2026-11-10T01:17:15.747
Link: CVE-2026-115864
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T22:45:08Z