Starman versions prior to 0.4018 for Perl contain an HTTP Request Smuggling vulnerability due to improper handling of HTTP headers. Specifically, when both Content-Length and Transfer-Encoding: chunked headers are included in a request, Starman incorrectly gives precedence to Content-Length instead of Transfer-Encoding as mandated by RFC 7230 section 3.3.3. This inconsistency can be exploited by attackers to smuggle malicious HTTP requests through front-end reverse proxies, potentially bypassing security controls or causing unintended behavior in backend services. The vulnerability is tracked as CVE-2026-40560 and is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests). No patch or official remediation has been published yet.

Successful exploitation allows an attacker to perform HTTP Request Smuggling attacks against Starman servers, potentially enabling them to bypass security controls implemented by front-end proxies. This can lead to unauthorized request injection or manipulation. The CVSS score of 7.5 reflects high confidentiality impact but no integrity or availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider deploying additional protections at the proxy or firewall level to detect or block suspicious HTTP requests containing conflicting Content-Length and Transfer-Encoding headers. Monitoring for unusual HTTP traffic patterns may help identify attempted exploitation.