Starman before 0.4019 has four Perl HTTP handling flaws
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.
46
CVE-2026-115817
Worker exhaustion via stalled request body in Starman before 0.4019
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Starman for Perl reads Content-Length and chunked request bodies with blocking reads and no deadline; read_timeout applies only to headers. A remote client that sends complete headers and then stalls or trickles the body holds a worker until it disconnects. A few such connections can occupy every worker (five by default), so the server stops answering requests. Versions before 0.4019 are affected.
What to do: Upgrade Starman to 0.4019, which applies read_timeout to body reads and adds a body_timeout (300 seconds by default).
| Product | Affected | Fixed in |
|---|---|---|
| Perl Starman | before 0.4019 | 0.4019 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests. Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
- Weakness
- CWE-770