Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability that allows CPU exhaustion via regular expression backtracking when decoding chunked request bodies. The flaw arises because the chunk-size line matching can cause the regex engine to retry matches quadratically with the length of the input, and there is no limit on the length of the run. A remote attacker can exploit this by sending a specially crafted 128 KiB request, causing a worker to consume about a minute of CPU time.