Starman before 0.4019 has four Perl HTTP handling flaws
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.
46
CVE-2026-115822
CPU exhaustion via regex backtracking in Starman before 0.4019
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Starman before 0.4019 decodes chunked HTTP request bodies with a regex that can backtrack quadratically on a long run of hex digits followed by a bare line feed and then CRLF. Nothing limits that line’s length. A remote attacker can send such requests to any route and exhaust worker CPU without authentication or user interaction.
What to do: Upgrade Starman to 0.4019.
| Product | Affected | Fixed in |
|---|---|---|
| Starman | before 0.4019 | 0.4019 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.
- Weakness
- CWE-1333