Monoceros before 0.30 can exhaust memory via Content-Length
Original title: CVE-2026-115864: Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory
A request that declares a large Content-Length can kill a Monoceros worker by exhausting memory.
Robert Rothenberg reported CVE-2026-115864 in Monoceros, a Perl component, on the oss-security list. Versions before 0.30 allow a request declaring a large Content-Length to kill a worker by exhausting memory. The available post is only a feed snippet, so no exploit status or further technical detail is included.
Unconfirmed: The mailing-list body is truncated, so exploitation status is not stated.
- The issue is tracked as CVE-2026-115864.
- Affected releases are Monoceros versions before 0.30.
- The failure mode is worker death from memory exhaustion.
Impact: Remote request can exhaust memory and kill a worker
| Product | Affected | Fixed in |
|---|---|---|
| Monoceros | before 0.30 | 0.30 |
- 1.Upgrade Monoceros to 0.30.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115864 | Memory-exhaustion DoS in Monoceros for Perl before 0.30 | — | — |
From the original article
Posted by Robert Rothenberg on Nov 09 ======================================================================== https://metacpan. org/dist/Monoceros VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.