CVE-2026-116127
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Starlet versions before 0.33 for Perl, responses to HEAD requests include a body, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent; with Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator; responses with status 204 or 304 are also sent with their body.
Risk Assessment
Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled (the default); a client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.
Recommendation
Upgrade Starlet to version 0.33 or later.
Other vulnerabilities in Starlet
See all- CVE-2026-116128Low risk· EPSS 15%
In Starlet versions from 0.20 before 0.33 for Perl, memory exhaustion is possible via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input; nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read; the data of a large chunk is also held in the buffer until the whole chunk has arrived.
- CVE-2026-115866Low risk· EPSS 15%
In Starlet versions from 0.20 before 0.33 for Perl, CPU exhaustion is possible via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF; a run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length; nothing limits the length of the run, which can span several reads.
- CVE-2026-115865Low risk· EPSS 15%
In Starlet versions before 0.33 for Perl, a request declaring a large Content-Length can kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once; Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
- CVE-2026-40561Medium
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present, whereas per RFC 7230 3.3.3 Transfer-Encoding must take precedence.
Original NVD description (English source)
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body. Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS