Starman before 0.4019 has three named Perl CVEs
No newer report adds facts about the Starman issues fixed in 0.4019.
Starman for Perl before 0.4019 is affected by three named CVEs that can stall workers, exhaust CPU, or desynchronize connections.
Robert Rothenberg reported flaws in Starman for Perl on oss-security, fixed in 0.4019. Before that release, a stalled request body can hold a worker indefinitely because read_timeout covers only headers. Chunked-body parsing can exhaust CPU through quadratic regex backtracking. A third flaw sends response bodies for HEAD requests and desynchronizes the connection. The post refers to four CVEs, but the visible text names only three and cuts off before the fourth.
- CVE-2026-115817: a stalled body can hold a worker indefinitely.
- CVE-2026-115822: chunked-body parsing can exhaust CPU via regex backtracking.
- CVE-2026-115823: HEAD responses include bodies and desynchronize the connection.
- Named issues affect Starman versions before 0.4019.
- The post title cites four CVEs; the visible text names three.
Timeline
dated events in the reporting · oldest first- Oct 26, 2026Rothenberg reports Starman flaws fixed in 0.4019. · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames three of four claimed Starman CVEs and the 0.4019 fix.
- CVEs
- CVE-2026-115817CVE-2026-115822CVE-2026-115823CVE-2026-115865CVE-2026-115866CVE-2026-116127CVE-2026-116131CVE-2026-116132CVE-2026-116133
- Products
- StarmanStarletHTTP::Body
Coverage
oldest first · one row per article · UTC- · 5d ago
oss-securityFirst report
Starman before 0.4019 has four Perl HTTP handling flaws
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.
- · 2d ago
Perl HTTP::Body before 1.23_01 allows resource exhaustion
Three named flaws cover unlimited form parts, leftover multipart temp files, and quadratic CPU use; the note is cut off.
- · 15h ago
Starlet before 0.33 for Perl has request-handling flaws
A large Content-Length can kill a worker, and chunked bodies from 0.20 can exhaust CPU.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-115817+1 related CVE | Worker exhaustion via stalled request body in Starman before 0.4019 | — | — | ||
| CVE-2026-115822 | CPU exhaustion via regex backtracking in Starman before 0.4019 | — | — | ||
CVE-2026-115865+2 related CVEs | Memory exhaustion DoS in Starlet before 0.33 | — | — | ||
CVE-2026-116131+1 related CVE | Resource exhaustion in Perl HTTP::Body before 1.23_01 | — | — | ||
| CVE-2026-116133 | CPU exhaustion in Perl HTTP::Body before 1.23_01 | — | — |