Zero Radar
← feed
HighVulnerabilityCVE-2026-115822updated 26 Oct 2026, 17:17 UTC

Starman Perl web server can be overloaded by a crafted chunked request

A specially crafted web request can make the Starman web server use up a lot of processor time, slowing or freezing it for everyone. Attackers can cause this without logging in.

Fixed in Starman 0.4019 or laterOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesStarman 0.4019 or later · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestChunk-size line of hex digits with bare LF
  2. 2Request reaches serverAny route accepts chunked bodies
  3. 3Regex backtracksQuadratic time on the long hex run
  4. 4Worker CPU exhaustedRepeated requests tie up workers
  5. ResultServer becomes unresponsive to legitimate users

What happened

Starman before 0.4019 (Perl PSGI server) parses chunked request bodies with a regex that backtracks quadratically on long hex-digit chunk-size lines ending in bare LF, and nothing limits that line length.

Why it is dangerous: A remote attacker can exhaust worker CPU by sending these requests to any route, causing denial of service for the site.

Are you affected?

You are affected if you run Starman versions before 0.4019 for Perl and it accepts chunked request bodies from untrusted clients.

Starman for Perl, versions before 0.4019

What to do

  1. Update Starman to version 0.4019 or later
  2. If you cannot update right away, put a reverse proxy in front that limits request size and rejects chunked bodies
  3. Monitor worker CPU usage for unusual spikes

Timeline

  1. 25 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 00:29 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 00:31 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 17:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115822
EPSS
0.3% chance of exploitation within 30 days
Disclosed
25 Oct 2026, 17:17 UTC
On Zero Radar
26 Oct 2026, 00:31 UTC (7 h after disclosure)
Last change
26 Oct 2026, 17:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Starman Perl web server can be overloaded by a crafted chunked request · Zero Radar