Starlet versions through 0.31 for Perl are vulnerable to HTTP Request Smuggling due to improper header precedence. The software incorrectly prioritizes the Content-Length header over Transfer-Encoding: chunked when both are present, violating RFC 7230 section 3.3.3. This flaw allows an attacker to smuggle malicious HTTP requests through a front-end reverse proxy.