CVE-2026-115823: Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Q: Which deployments are most exposed to this issue?

Deployments that use Starman before 0.4019 with keep-alive or pipelined connections are affected. Risk is particularly relevant when a front-end proxy reuses upstream connections, because it can associate a response with the wrong request.

Q: What request or response conditions trigger the desynchronization?

A HEAD request triggers it when the application returns a body, because Starman writes that body even though it omits chunked framing. Responses with 1xx, 204, or 304 status can also carry a body and cause the same response-boundary problem.

Q: What should be changed to remediate the issue?

Upgrade Starman to version 0.4019 or later. The provided fix applies to both array and streaming response paths.

Published Oct 25, 2026

Updated

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.

For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.

On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.

Affected Software

1 affected component

Starman Starman<0.4019

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Starman to a version that resolves this vulnerability.
Fixed in 0.4019

Event History

Oct 25, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments that use Starman before 0.4019 with keep-alive or pipelined connections are affected. Risk is particularly relevant when a front-end proxy reuses upstream connections, because it can associate a response with the wrong request.

What request or response conditions trigger the desynchronization?

A HEAD request triggers it when the application returns a body, because Starman writes that body even though it omits chunked framing. Responses with 1xx, 204, or 304 status can also carry a body and cause the same response-boundary problem.

What should be changed to remediate the issue?

Upgrade Starman to version 0.4019 or later. The provided fix applies to both array and streaming response paths.

CVE-2026-115823: Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What request or response conditions trigger the desynchronization?

What should be changed to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What request or response conditions trigger the desynchronization?

What should be changed to remediate the issue?