CVE-2026-115824: Starman (Perl module) · Unthrottled Resource Allocation
Affects Starman (Perl module)Source CVE Database V5
Not known to be exploited : upgrade to 0.4019 soon.
Data as of 25 Oct 2026, 17:13 UTC
Rated High by the CNA (CPANSec) · CVSS not yet scored by NVD
- Patch
- Available – fixed in 0.4019
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Upgrade Starman (Perl module) to 0.4019.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
CPANStarmanpkg:cpan/StarmanOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should upgrade to Starman version 0.4019 or later once available, as versions before 0.4019 are affected. If you cannot patch yet, consider limiting the size of incoming chunked request bodies at a proxy or firewall level to mitigate exploitation risk. Monitor for unusually large or malformed chunked requests.
Description
CVE-2026-115824 affects Starman versions before 0.4019 for Perl and allows a remote attacker to exhaust worker memory by sending specially crafted chunked HTTP request bodies. The vulnerability arises because the chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling unbounded memory consumption.