The vulnerability in Monoceros before 0.30 for Perl allows a specially crafted HTTP request that declares an excessively large Content‑Length header. The framework reads the request body in a single sysread call sized to the declared length, causing Perl to allocate a buffer that exceeds available memory. This results in an uncatchable out‑of‑memory error, terminating the worker process before the application logic is executed. Each request of only a few bytes can trigger this failure, effectively allowing a remote attacker to force worker restarts and disrupt service.

All deployments of Monoceros for Perl older than version 0.30 are affected. The issue is specific to the Monoceros framework and does not extend to other Perl web frameworks or unrelated software.

The vulnerability is exploitable over the network via a crafted HTTP request and does not require authentication. Since no EPSS score is available, the risk of exploitation cannot be quantified precisely, but the lack of a KEV listing indicates no documented public exploits yet. The severity arises from the ability to cause worker process termination, leading to a denial‑of‑service condition across the application.