CVE-2026-116128: Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies

Q: Which deployments are exposed to this issue?

Deployments using Starlet for Perl from version 0.20 up to, but not including, 0.33 are affected when they process chunked HTTP request bodies. A remote client can target a worker with a single request.

Q: What does an attacker need to send to trigger memory exhaustion?

The attacker can send a chunked request with a chunk-size line that never terminates with CRLF, continuously growing the unconsumed-input buffer. They can also declare a large chunk, causing its data to remain buffered until the entire chunk arrives.

Q: Why does a read timeout not necessarily stop the attack?

The read timeout restarts after every read. A client that continues sending data can keep the connection active while causing the buffer to grow.

Published Oct 30, 2026

Updated

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.

The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.

A remote attacker can exhaust a worker's memory with a single request.

Affected Software

4 affected componentsFixes available

debian/starlet*

debian/starlet<=0.31-2, <=0.31-2+deb13u1, <=0.32-1

0.33-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/starlet to a version that resolves this vulnerability.
Fixed in 0.33-1
Upgrade
Upgrade Starlet to a version that resolves this vulnerability.
Fixed in 0.33

Event History

Oct 30, 2026

CVE Published

via MITRE·12:46 PM

Data Sourced

via MITRE·12:46 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·12:46 PM

DescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Data Sourced

via OSV·01:18 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Starlet for Perl from version 0.20 up to, but not including, 0.33 are affected when they process chunked HTTP request bodies. A remote client can target a worker with a single request.

What does an attacker need to send to trigger memory exhaustion?

The attacker can send a chunked request with a chunk-size line that never terminates with CRLF, continuously growing the unconsumed-input buffer. They can also declare a large chunk, causing its data to remain buffered until the entire chunk arrives.

Why does a read timeout not necessarily stop the attack?

The read timeout restarts after every read. A client that continues sending data can keep the connection active while causing the buffer to grow.

CVE-2026-116128: Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to send to trigger memory exhaustion?

Why does a read timeout not necessarily stop the attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to send to trigger memory exhaustion?

Why does a read timeout not necessarily stop the attack?