CVE-2026-115865
Low risk· EPSS 15%Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Starlet versions before 0.33 for Perl, a request declaring a large Content-Length can kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once; Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
Risk Assessment
A remote attacker can force a worker restart with each request of a few bytes.
Recommendation
Upgrade Starlet to version 0.33 or later.
Other vulnerabilities in Starlet
See all- CVE-2026-116128Low risk· EPSS 15%
In Starlet versions from 0.20 before 0.33 for Perl, memory exhaustion is possible via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input; nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read; the data of a large chunk is also held in the buffer until the whole chunk has arrived.
- CVE-2026-116127Low risk· EPSS 5%
In Starlet versions before 0.33 for Perl, responses to HEAD requests include a body, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent; with Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator; responses with status 204 or 304 are also sent with their body.
- CVE-2026-115866Low risk· EPSS 15%
In Starlet versions from 0.20 before 0.33 for Perl, CPU exhaustion is possible via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF; a run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length; nothing limits the length of the run, which can span several reads.
- CVE-2026-40561Medium
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present, whereas per RFC 7230 3.3.3 Transfer-Encoding must take precedence.
Original NVD description (English source)
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS