CVE-2026-115817
UnknownSummary
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only headers. Bodies are read with blocking reads and no deadline. An attacker can occupy all workers with a few connections.
Risk Assessment
A remote attacker can exhaust the worker pool and stop the server from responding. With the default five workers, a few connections suffice.
Recommendation
Update Starman to version 0.4019 or later, which applies read_timeout to body reads and adds body_timeout. Consider increasing worker count as a temporary measure.
Other vulnerabilities in Starman
See all- CVE-2026-115824Unknown
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The decoder does not limit chunk-size line length or buffer size. A remote attacker can exhaust worker memory with a single connection.
- CVE-2026-115823Unknown
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. Bodies are also sent for 1xx, 204, and 304 statuses. A client or proxy may read those bytes as the start of the next response.
- CVE-2026-115822Unknown
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. A hex line followed by a bare LF and CRLF never matches, and each attempt backtracks quadratically. Line length is unbounded.
- CVE-2026-40560High
Starman for Perl before version 0.4018 is vulnerable to HTTP Request Smuggling due to improper header precedence. Starman incorrectly prioritizes Content-Length over Transfer-Encoding: chunked, violating RFC 7230. An attacker can exploit this to smuggle malicious HTTP requests through a front-end reverse proxy.
Original NVD description (English source)
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests. Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS