KAZUHO Starlet versions up to 0.31 for Perl contain a vulnerability classified as CWE-444 (Inconsistent Interpretation of HTTP Requests), commonly known as HTTP Request Smuggling. The issue arises because Starlet incorrectly gives precedence to the Content-Length header over the Transfer-Encoding: chunked header when both are included in an HTTP request. According to RFC 7230 section 3.3.3, Transfer-Encoding must take precedence. This inconsistency can be exploited by attackers to smuggle unauthorized HTTP requests through front-end reverse proxies, potentially bypassing security controls or causing request misrouting.

The vulnerability allows an attacker to perform HTTP Request Smuggling attacks, which can lead to request misrouting or bypassing security controls in front-end reverse proxies. The CVSS score of 5.3 (medium severity) reflects that the impact is limited to integrity loss without confidentiality or availability impact. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider deploying additional protections at the reverse proxy or web application firewall level to detect or block suspicious HTTP request patterns involving conflicting Content-Length and Transfer-Encoding headers.