Starman before 0.4019 has four Perl HTTP handling flaws
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.
46
CVE-2026-115823
HTTP response desync in Starman before 0.4019
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Starman before 0.4019 writes response bodies for HEAD requests and for 1xx, 204, and 304 responses while omitting chunked framing. On a keep-alive or pipelined connection, a client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections can then pair responses with the wrong requests. Perl apps served by those Starman versions are affected.
What to do: Upgrade Starman to 0.4019.
| Product | Affected | Fixed in |
|---|---|---|
| Perl Starman | before 0.4019 | 0.4019 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
- Weakness
- CWE-444