Cyber ·
Starlet for Perl before 0.33: four CVEs covering resource exhaustion and corrupted HTTP responses
Security advisory in the oss-sec feed, dated 30 October 2026, describing four CVEs in Starlet for Perl versions before 0.33, including memory and CPU exhaustion from crafted requests.
On 30 October 2026, Robert Rothenberg posted to the oss-sec feed an advisory on four CVEs in Starlet, a Perl web server. According to the text, versions before 0.33 are affected. Three identifiers appear in the available excerpt. CVE-2026-115865 lets a request declaring a large Content-Length exhaust memory and terminate a worker. CVE-2026-115866 affects versions from 0.20 up to before 0.33 and causes CPU exhaustion through regular expression backtracking while decoding request bodies sent in chunks. CVE-2026-116127 makes responses to HEAD requests include a body, which corrupts the next response. The fourth CVE does not appear in the excerpt, so its effect cannot be described from this source. To consult the original, search the public 2026 oss-sec archive for the identifiers above and check the affected version list and the fix the maintainers name. For a reader, the relevance is finding out whether any service in your organization uses Starlet, directly or indirectly. This advisory does not concern Rota Nacional as an AI platform, but anyone running their own Perl infrastructure in front of the API should handle it in that server layer.
Original source: Starlet para Perl anterior à versão 0.33 (4 CVEs)