Starman before 0.4019 has four Perl HTTP handling flaws
Original title: Starman versions before 0.4019 for Perl (4 CVEs)
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.
Robert Rothenberg reported four CVEs in Starman for Perl, fixed in 0.4019. Before that release, a stalled request body can hold a worker because read_timeout covers only headers, and chunked-body parsing can exhaust CPU through quadratic regex backtracking. A third flaw sends response bodies for HEAD requests and desynchronizes the connection; the snippet cuts off before the fourth CVE.
Unconfirmed: The snippet names three of the four CVEs and cuts off the rest of CVE-2026-115823.
- CVE-2026-115817: a stalled body can hold a worker indefinitely.
- CVE-2026-115822: chunked-body parsing can exhaust CPU via regex backtracking.
- CVE-2026-115823: HEAD responses include bodies and desynchronize the connection.
- All named issues affect Starman versions before 0.4019.
Impact: Worker hang, CPU exhaustion, and HTTP response desynchronization
| Product | Affected | Fixed in |
|---|---|---|
| Starman | before 0.4019 | 0.4019 |
- 1.Upgrade Starman to 0.4019 or later.
- Products
- Starman
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-115817+1 related CVE | Worker exhaustion via stalled request body in Starman before 0.4019 | — | — | ||
| CVE-2026-115822 | CPU exhaustion via regex backtracking in Starman before 0.4019 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 25 CVE-2026-115817 Starman versions before 0. 4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers CVE-2026-115822 Starman versions before 0. 4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies CVE-2026-115823 Starman versions before 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.