CVE-2026-115822: Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Q: Who can exploit this issue?

A remote attacker can exploit it by sending malformed chunked HTTP request bodies to a Starman server. The affected parsing occurs before the application is called, so any route can be targeted.

Q: What request pattern triggers the CPU exhaustion?

The attacker sends a chunk-size line containing a long run of hexadecimal characters followed by a bare LF and then CRLF. This causes the chunk-size regular expression to fail only after quadratic backtracking, and the line length is not limited.

Q: Are default deployments affected?

The provided information does not identify any configuration prerequisite beyond running a Starman version before 0.4019 and accepting requests with chunked request bodies.

Q: What version resolves the issue?

Starman 0.4019 includes the referenced fix. Versions before 0.4019 are affected.

Published Oct 25, 2026

Updated

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.

Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^(([0-9a-fA-F]+).\015\012)//. A line of hex digits followed by a bare LF and then CRLF never matches, because . does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.

A remote attacker can exhaust worker CPU by sending such requests to any route.

Affected Software

1 affected component

cpan/Starman<0.4019

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Starman to a version that resolves this vulnerability.
Fixed in 0.4019

Event History

Oct 25, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker can exploit it by sending malformed chunked HTTP request bodies to a Starman server. The affected parsing occurs before the application is called, so any route can be targeted.

What request pattern triggers the CPU exhaustion?

The attacker sends a chunk-size line containing a long run of hexadecimal characters followed by a bare LF and then CRLF. This causes the chunk-size regular expression to fail only after quadratic backtracking, and the line length is not limited.

Are default deployments affected?

The provided information does not identify any configuration prerequisite beyond running a Starman version before 0.4019 and accepting requests with chunked request bodies.

What version resolves the issue?

Starman 0.4019 includes the referenced fix. Versions before 0.4019 are affected.

CVE-2026-115822: Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What request pattern triggers the CPU exhaustion?

Are default deployments affected?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What request pattern triggers the CPU exhaustion?

Are default deployments affected?

What version resolves the issue?