CVE-2026-116128
Low risk· EPSS 15%Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Starlet versions from 0.20 before 0.33 for Perl, memory exhaustion is possible via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input; nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read; the data of a large chunk is also held in the buffer until the whole chunk has arrived.
Risk Assessment
A remote attacker can exhaust a worker's memory with a single request.
Recommendation
Upgrade Starlet to version 0.33 or later.
Other vulnerabilities in Starlet
See all- CVE-2026-116127Low risk· EPSS 5%
In Starlet versions before 0.33 for Perl, responses to HEAD requests include a body, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent; with Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator; responses with status 204 or 304 are also sent with their body.
- CVE-2026-115866Low risk· EPSS 15%
In Starlet versions from 0.20 before 0.33 for Perl, CPU exhaustion is possible via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF; a run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length; nothing limits the length of the run, which can span several reads.
- CVE-2026-115865Low risk· EPSS 15%
In Starlet versions before 0.33 for Perl, a request declaring a large Content-Length can kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once; Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
- CVE-2026-40561Medium
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present, whereas per RFC 7230 3.3.3 Transfer-Encoding must take precedence.
Original NVD description (English source)
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived. A remote attacker can exhaust a worker's memory with a single request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS