CVE-2026-115865: Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a
Source GCVE Database
Not known to be exploited : upgrade to 0.33 soon.
Data as of 30 Oct 2026, 17:03 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 0.33
Exploitation evidence
Disclosed: evidence found.
CVE published 30 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Upgrade Starlet (Perl module) to 0.33.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Starlet | Affected
| Fixed in
|
CPANStarletpkg:cpan/StarletOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
If you cannot patch yet, consider limiting the size of Content-Length headers accepted or implementing request filtering to block suspiciously large Content-Length values to mitigate exploitation.
Description
Starlet versions before 0.33 for Perl contain a vulnerability where a request declaring a large Content-Length header can cause a worker process to exhaust memory and exit unexpectedly. This occurs because the request body is read in a loop that attempts to allocate a buffer equal to the declared Content-Length before any data is received, leading to an uncatchable out-of-memory error. A remote attacker can exploit this by sending small requests with large Content-Length headers to repeatedly force worker restarts.