Zero Radar
← feed
HighVulnerabilityCVE-2026-115865updated 30 Oct 2026, 17:22 UTC

Starlet (Perl web server) can be crashed by one oversized request

A single crafted web request that claims a huge body size can make the server's worker process run out of memory and exit. Repeating it keeps the service down or restarting.

Fixed in Starlet 0.33 or later · out Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesStarlet 0.33 or later · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestFew bytes, huge Content-Length declared
  2. 2Starlet reads bodyAsks sysread for full declared length
  3. 3Buffer allocatedPerl grows buffer before data arrives
  4. 4Worker crashesUncatchable out-of-memory exit
  5. ResultWorker restarts, service disrupted

What happened

Starlet versions before 0.33 for Perl read the request body by asking sysread for the entire declared Content-Length at once, so a very large declared length makes Perl allocate an oversized buffer before data arrives and the worker dies with an uncatchable out-of-memory error.

Why it is dangerous: A remote attacker can repeatedly force worker restarts with requests of only a few bytes, causing denial of service for applications served by Starlet.

Are you affected?

You are affected if you run Starlet earlier than 0.33 for Perl as a web server or application server.

Starlet for Perl, versions before 0.33

What to do

  1. Upgrade Starlet for Perl to version 0.33 or later
  2. Check your installed version with cpan or your Perl dependency manifest and confirm it reads 0.33 or higher
  3. Until patched, place a reverse proxy in front that enforces a maximum request body size

Timeline

  1. 30 Oct 2026, 13:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:45 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 16:00 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115865
Disclosed
30 Oct 2026, 13:18 UTC
On Zero Radar
30 Oct 2026, 16:00 UTC (3 h after disclosure)
Last change
30 Oct 2026, 17:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Starlet (Perl web server) can be crashed by one oversized request · Zero Radar