Skip to content
Fencer Intel
no cvss —

CVE-2026-115864 json

Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory

published 2d ago modified 2d ago also EUVD-2026-120453

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.

The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.

A remote attacker can force a worker restart with each request of a few bytes.

Patch / fix

  • cpan Monoceros 0.30

Is CVE-2026-115864 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-11).

Affected products

  • cpan Monoceros

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.