Zero Radar
← feed
HighVulnerabilityCVE-2026-115823updated 26 Oct 2026, 17:17 UTC

Starman (Perl web server) sends extra bytes on HEAD requests, confusing clients

Starman, a web server for Perl programs, sometimes sends content it should not send when a client only asks for headers. On connections that are reused, the client can read that leftover data as the answer to a different request, mixing up

Fixed in Starman 0.4019 or laterOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesStarman 0.4019 or later · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Starman before 0.4019 writes response bodies for HEAD requests and for 1xx, 204 and 304 responses, on both array and streaming paths, which desynchronizes responses on keep-alive or pipelined connections.

Why it is dangerous: A front-end proxy that reuses upstream connections may pair responses with the wrong requests, which can expose one user's content to another or cause unexpected application behavior.

Are you affected?

You are affected if you run Starman versions before 0.4019 for Perl, especially behind a proxy that reuses connections to it.

Starman for Perl, versions before 0.4019

What to do

  1. Upgrade Starman to version 0.4019 or later
  2. If you cannot upgrade yet, disable keep-alive between your proxy and Starman
  3. Review proxy logs for mismatched or unexpected responses

Timeline

  1. 25 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 00:29 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 00:31 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 17:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115823
EPSS
0.2% chance of exploitation within 30 days
Disclosed
25 Oct 2026, 17:17 UTC
On Zero Radar
26 Oct 2026, 00:31 UTC (7 h after disclosure)
Last change
26 Oct 2026, 17:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Starman (Perl web server) sends extra bytes on HEAD requests, confusing clients · Zero Radar