Zero Radar
← feed
HighVulnerabilityCVE-2026-115817updated 26 Oct 2026, 17:17 UTC

Starman Perl web server can be stalled by slow request bodies

A client can open a few connections, send the headers, and then never finish sending the request body. The server keeps waiting on each one, so it can run out of workers and stop answering other visitors.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesStarman 0.4019 (applies read_timeout to each body read and adds body_timeout, 300 seconds by default, on total body read time) · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker connectsOpens a few connections to the server
  2. 2Headers sentComplete headers are accepted normally
  3. 3Body stallsRequest body is trickled or never finished
  4. 4Workers heldNo deadline, so each worker waits indefinitely
  5. 5Server unresponsiveLegitimate requests cannot be served
  6. ResultServer stops answering requests

What happened

Starman versions before 0.4019 read Content-Length and chunked request bodies with blocking reads and no deadline, so read_timeout only covers headers; a stalled or trickled body holds a worker until the client disconnects.

Why it is dangerous: A remote attacker needs only a few such connections (five with the default worker count) to make the server unresponsive, causing denial of service for anyone relying on it.

Are you affected?

You are affected if you run Starman for Perl versions before 0.4019 exposed to untrusted clients.

Starman for Perl, all versions before 0.4019

What to do

  1. Upgrade Starman to version 0.4019 or later
  2. Confirm body_timeout is set (default 300 seconds) in your configuration
  3. If you cannot upgrade, place a reverse proxy with request body timeouts in front of Starman

Timeline

  1. 25 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 00:29 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 00:31 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 17:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115817
EPSS
0.3% chance of exploitation within 30 days
Disclosed
25 Oct 2026, 17:17 UTC
On Zero Radar
26 Oct 2026, 00:31 UTC (7 h after disclosure)
Last change
26 Oct 2026, 17:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Starman Perl web server can be stalled by slow request bodies · Zero Radar