Vulnerability feed

Executive summary

Starman, a Perl web server, has a flaw that lets an attacker exhaust server memory by sending chunked request bodies that the server keeps buffering without limit. The advisory does not state a severity rating or CVSS score. The fix is included in version 0.4019, and the advisory indicates the patch is available in the repository.

Technical summary

The advisory describes unbounded buffering of chunked request bodies in the chunk decoder, which can cause memory exhaustion, and the commit message also describes a quadratic-backtracking regex in chunk-size line parsing (CVE-2026-115822) that consumes CPU. The attack requires sending crafted chunked HTTP requests to a Starman server; the advisory does not state authentication or other preconditions. Affected versions are stated as those before 0.4019, and the fixed version is 0.4019. The fix replaces the regex with index() and an anchored parser, limits chunk-size lines to 4096 bytes, rejects sizes over 13 hex digits with 400 and closes the connection, and makes _prepare_env return an error status so bad bodies are not dispatched. No workarounds are stated, and no detection guidance or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch

Score

No CVSS score published.

Affects

StarmanStarman

Executive summary

Starman, a Perl web server, sends response bodies for HEAD requests and for 1xx, 204 and 304 responses, which can cause response desynchronization on keep-alive connections. The advisory does not state a severity rating or an exploitation status, and the fix is in Starman versions 0.4019 and later.

Technical summary

The flaw is a response desynchronization issue (HTTP response smuggling class) in Starman before 0.4019 for Perl, where bodies are written for HEAD, 1xx, 204 and 304 responses even though those responses must not carry a body. On keep-alive or pipelined connections, the extra bytes are read as the start of the next response, and a front end that pools upstream connections can be affected. The advisory does not state a CVSS score, attack preconditions beyond keep-alive or pipelined connections, or a workaround. The fix is in commit 91c47c529cd1e100f938486896ea9083ec3ec7bf, which skips body output for these responses and closes object bodies without reading them, and it adds a test file t/no_body_response.t. Detection guidance is not stated, and the advisory names no specific fixed release beyond the version threshold of 0.4019.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch

Score

No CVSS score published.

Affects

StarmanStarman

Executive summary

The advisory says Starman, a Perl web server, is affected by a flaw that lets a remote sender exhaust CPU on the server by sending chunked request bodies with long runs of hex digits. The advisory does not give a severity rating or CVSS score. The vendor-side fix is a code change that rejects malformed or overly long chunk-size lines with a 400 error, and the advisory says versions before 0.4019 are affected.

Technical summary

The flaw is a regular expression backtracking problem (quadratic complexity, a form of algorithmic CPU exhaustion) in parsing the chunk-size line of chunked request bodies, which the commit message says ran again over the whole buffer after every read. The attacker needs only to send an HTTP request with Transfer-Encoding: chunked; the advisory says 32 KiB of input cost about 1.7 seconds of worker CPU. The fix bounds chunk-size lines to 4096 bytes, parses them with an anchored linear-time pattern, rejects sizes with more than 13 significant hex digits, and returns 400 and closes the connection on malformed input. The advisory states affected versions as before 0.4019, but it does not state a fixed version number explicitly, and no workaround is stated. No detection guidance or evidence of exploitation in the wild is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch

Score

No CVSS score published.

Affects

StarmanStarman

Executive summary

Starman, a Perl web server, has a flaw where a client that sends a request body and then stalls can keep a server worker busy indefinitely, which can exhaust workers with only a few connections. The advisory describes the severity only in terms of workers being taken; a CVSS score is not stated. The fix adds a total time limit for reading request bodies, and the advisory's guidance is to update Starman to a release at or after 0.4019 (the fixed version is stated as 0.4019 in the advisory's wording of affected versions before 0.4019).

Technical summary

The weakness is a resource exhaustion issue (missing timeout on request body reads): read_timeout applied only to request headers, so a Content-Length or chunked body could stall or trickle indefinitely. The attack requires only network access to the Starman listener and a few open connections to tie up workers, and no authentication is mentioned. Affected versions are stated as before 0.4019 and the fix adds a --body-timeout option (body_timeout, default 300 seconds, 0 disables) that responds with 408 Request Timeout and closes the connection. The advisory does not state a CVSS score, a CWE, exploitation in the wild, or detection guidance beyond the timeout behavior, and it recommends a reverse proxy that buffers request bodies as a mitigation. Workaround details beyond setting body_timeout are not otherwise stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch

Score

No CVSS score published.

Affects

StarmanStarman