Zero Radar
← feed
HighVulnerabilityCVE-2026-115866updated 30 Oct 2026, 17:22 UTC

Starlet (Perl web server) can be stalled by crafted chunked requests

A specially crafted web request can make the Starlet web server spend a lot of CPU time on one request, slowing or freezing that worker. An attacker can do this with a single request, without logging in.

Fixed in Starlet 0.33 or later · out Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesStarlet 0.33 or later · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends one crafted chunked request
  2. 2Chunk-size lineLong hex run followed by bare LF
  3. 3Regex engineBacktracks, cost grows quadratically
  4. 4Worker stalledCPU busy for about a minute
  5. ResultWorker is tied up, service degrades

What happened

Starlet, a Perl PSGI web server, uses a regular expression to decode chunk-size lines in chunked request bodies. Long runs of hex digits followed by a bare LF trigger catastrophic regex backtracking, causing CPU exhaustion.

Why it is dangerous: A remote attacker can tie up a server worker for about a minute of CPU time with one 128 KiB request, before the application code runs. Repeated requests can degrade or deny service for sites running Starlet.

Are you affected?

You are affected if you run Starlet from version 0.20 up to (not including) 0.33 for Perl and accept chunked request bodies from untrusted clients.

Starlet for Perl, versions from 0.20 before 0.33

What to do

  1. Upgrade Starlet to version 0.33 or later
  2. Check your Perl dependency lists (cpanfile, Makefile.PL, or deployment images) to confirm the installed version
  3. If you cannot upgrade right away, limit request sizes and timeouts at a reverse proxy in front of Starlet

Timeline

  1. 30 Oct 2026, 13:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:45 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 16:00 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115866
Disclosed
30 Oct 2026, 13:18 UTC
On Zero Radar
30 Oct 2026, 16:00 UTC (3 h after disclosure)
Last change
30 Oct 2026, 17:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Starlet (Perl web server) can be stalled by crafted chunked requests · Zero Radar