CVE-2026-115824: Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Q: Which deployments are exposed to this issue?

Deployments using Starman for Perl before version 0.4019 are affected. A remote client can target a worker over a single connection.

Q: What does an attacker need to do to trigger memory exhaustion?

The attacker needs to send a chunked request body and either declare a very large chunk size while streaming data or send a chunk-size line that does not end. The decoder continues growing its buffer while the client keeps sending data.

Q: Is a single connection sufficient to cause impact?

Yes. The issue can exhaust a worker's memory with a single remote connection.

Published Oct 25, 2026

Updated

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.

The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.

A remote attacker can exhaust worker memory with a single connection.

Affected Software

1 affected component

cpan/Starman<0.4019

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Starman to a version that resolves this vulnerability.
Fixed in 0.4019

Event History

Oct 25, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Starman for Perl before version 0.4019 are affected. A remote client can target a worker over a single connection.

What does an attacker need to do to trigger memory exhaustion?

The attacker needs to send a chunked request body and either declare a very large chunk size while streaming data or send a chunk-size line that does not end. The decoder continues growing its buffer while the client keeps sending data.

Is a single connection sufficient to cause impact?

Yes. The issue can exhaust a worker's memory with a single remote connection.

CVE-2026-115824: Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger memory exhaustion?

Is a single connection sufficient to cause impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger memory exhaustion?

Is a single connection sufficient to cause impact?