CVE-2026-115865: Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory

Q: What does an attacker need to do to trigger the worker failure?

A remote attacker only needs to send a request with a Content-Length larger than the worker's available memory. The request itself can contain only a few bytes of body data.

Q: Is application-level request handling or authentication reached before the failure?

No. The memory exhaustion occurs while Starlet reads the request body, before the application is called, so application-level validation and authentication do not prevent the worker failure.

Q: What is the operational impact of exploitation?

Each malicious request can cause a worker to exit with an uncatchable out-of-memory error, forcing a worker restart. Repeated requests can continually disrupt worker availability.

Q: Which versions are affected?

Starlet versions before 0.33 are affected. Version 0.33 is identified in the provided release information as the relevant fixed release.

Published Oct 30, 2026

Updated

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.

The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.

A remote attacker can force a worker restart with each request of a few bytes.

Affected Software

4 affected componentsFixes available

debian/starlet*

debian/starlet<=0.31-2, <=0.31-2+deb13u1, <=0.32-1

0.33-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/starlet to a version that resolves this vulnerability.
Fixed in 0.33-1
Upgrade
Upgrade Starlet to a version that resolves this vulnerability.
Fixed in 0.33

Event History

Oct 30, 2026

CVE Published

via MITRE·12:44 PM

Data Sourced

via MITRE·12:44 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·12:44 PM

DescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Data Sourced

via OSV·01:18 PM

Affected Software

Frequently Asked Questions

What does an attacker need to do to trigger the worker failure?

A remote attacker only needs to send a request with a Content-Length larger than the worker's available memory. The request itself can contain only a few bytes of body data.

Is application-level request handling or authentication reached before the failure?

No. The memory exhaustion occurs while Starlet reads the request body, before the application is called, so application-level validation and authentication do not prevent the worker failure.

What is the operational impact of exploitation?

Each malicious request can cause a worker to exit with an uncatchable out-of-memory error, forcing a worker restart. Repeated requests can continually disrupt worker availability.

Which versions are affected?

Starlet versions before 0.33 are affected. Version 0.33 is identified in the provided release information as the relevant fixed release.

CVE-2026-115865: Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to do to trigger the worker failure?

Is application-level request handling or authentication reached before the failure?

What is the operational impact of exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to trigger the worker failure?

Is application-level request handling or authentication reached before the failure?

What is the operational impact of exploitation?

Which versions are affected?