Cyber ·
Starman for Perl before 0.4019: four CVEs affecting workers and HTTP responses
Advisory from the oss-sec list, posted on October 25, 2026, describing four flaws in Starman for Perl before version 0.4019, with risks of blocked workers, CPU exhaustion and desynchronized responses.
The advisory describes four CVEs in Starman for Perl versions before 0.4019. According to the text received, CVE-2026-115817 lets a stalled request body keep a worker busy indefinitely, because read_timeout covers only the headers. CVE-2026-115822 allows CPU exhaustion through quadratic regex backtracking when parsing fragmented request bodies. CVE-2026-115823 causes responses to HEAD requests to include a body, desynchronizing responses. The text received is truncated and does not detail the fourth flaw, so it is not described here.
The source is a machine translation of a post on the oss-sec list dated October 25, 2026, made available in the feed on October 26. To check the scope, affected versions, fixes and full description of the four flaws, consult the original post on the 2026 oss-sec list and the record for each CVE, using the package name and CVE numbers as search keys.
Original source: Starman anterior à versão 0.4019 para Perl (4 CVEs)