Starlet before 0.33 for Perl has request-handling flaws
Original title: Starlet versions before 0.33 for Perl (4 CVEs)
A large Content-Length can kill a worker, and chunked bodies from 0.20 can exhaust CPU.
Robert Rothenberg posted on October 30 about flaws in the Perl HTTP server Starlet before 0.33. A declared large Content-Length can exhaust memory and kill a worker, and versions from 0.20 can burn CPU on regular-expression backtracking while decoding chunked bodies. HEAD responses that include a body can corrupt the following response; the post cuts off there.
Unconfirmed: The title says four CVEs, but the snippet names only three and cuts off the third.
- CVE-2026-115865 affects versions before 0.33 through Content-Length memory exhaustion.
- CVE-2026-115866 affects versions from 0.20 before 0.33.
- CVE-2026-116127 sends a body in responses to HEAD requests.
- The post names 0.33 as the fixed release.
Impact: worker memory or CPU exhaustion and response corruption
| Product | Affected | Fixed in |
|---|---|---|
| Starlet | before 0.33; CVE-2026-115866 from 0.20 before 0.33 | 0.33 |
- 1.Upgrade Starlet to version 0.33.
- Products
- Starlet
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-115865+2 related CVEs | Memory exhaustion DoS in Starlet before 0.33 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 30 CVE-2026-115865 Starlet versions before 0. 33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory CVE-2026-115866 Starlet versions from 0. 20 before 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.