KAZUHO Starlet versions up to 0.31 for Perl contain an HTTP Request Smuggling vulnerability caused by inconsistent interpretation of HTTP headers. Specifically, the server incorrectly gives precedence to the Content-Length header over the Transfer-Encoding: chunked header when both are present in an HTTP request. According to RFC 7230 section 3.3.3, Transfer-Encoding must take precedence. This discrepancy can be exploited by attackers to smuggle unauthorized HTTP requests via a front-end reverse proxy, potentially bypassing security controls or causing request confusion.

An attacker could exploit this vulnerability to perform HTTP Request Smuggling attacks, which may lead to unauthorized request injection or manipulation when the vulnerable Starlet server is used behind a reverse proxy. This can undermine the integrity of HTTP request handling and potentially allow bypassing of security mechanisms. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider deploying additional protections at the reverse proxy or web application firewall level to detect or block suspicious request patterns involving conflicting Content-Length and Transfer-Encoding headers.