Threat database

CVE-2026-115824 affects Starman versions before 0.4019 for Perl and allows a remote attacker to exhaust worker memory by sending specially crafted chunked HTTP request bodies. The vulnerability arises because the chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling unbounded memory consumption.

Starman versions before 0.4019 for Perl improperly handle HTTP HEAD requests by sending response bodies, causing desynchronization of responses on keep-alive connections. This leads to clients potentially reading response bytes as part of subsequent responses, which can cause front-end proxies to mismatch responses with requests.

CVE-2026-115822 is a vulnerability in Starman for Perl versions before 0.4019 that allows remote attackers to cause CPU exhaustion via inefficient regular expression processing. The issue arises from quadratic regex backtracking when parsing chunked request bodies, specifically due to a regex that fails to match certain malformed chunk-size lines, leading to excessive CPU usage. This can be triggered by sending crafted requests to any route handled by the server.

Starman versions before 0.4019 for Perl have a vulnerability where stalled request bodies can indefinitely occupy worker processes because read_timeout only applies to headers, not the body. This allows a remote attacker to exhaust all available workers by sending incomplete or slow request bodies, causing denial of service. Version 0.4019 introduces read_timeout for body reads and a body_timeout limit of 300 seconds to mitigate this issue.