Zero Radar
← feed
HighVulnerabilityCVE-2026-116127updated 30 Oct 2026, 17:22 UTC

Starlet web server for Perl sends unwanted data on HEAD requests

A small web server for Perl can send extra data in replies to some requests. This can mix up responses on connections that stay open, so a visitor could receive another request's reply.

Fixed in Starlet 0.33 or later · out Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesStarlet 0.33 or later · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Client sends HEADRequest for headers only
  2. 2Starlet repliesSends an unexpected body
  3. 3Connection reusedLeftover bytes stay on the wire
  4. 4Next response mixedReader takes extra bytes as next reply
  5. ResultResponses on shared connections get desynchronized

What happened

Starlet versions before 0.33 for Perl send a response body for HEAD requests, and do not pass the request method to the response writer. The extra bytes corrupt the next response on persistent or pipelined connections.

Why it is dangerous: A proxy or client reusing a connection may read the leftover bytes as the start of the next response, which can desynchronize shared connections and affect other users' responses.

Are you affected?

You are affected if you run Starlet for Perl versions before 0.33 serving HTTP/1.1 applications with persistent or pipelined connections, especially behind a proxy that shares connections.

Starlet for Perl, all versions before 0.33

What to do

  1. Update Starlet for Perl to version 0.33 or later
  2. If you cannot update right away, put a proxy in front that does not reuse connections across clients
  3. Check that your applications and middleware handle HEAD requests correctly

Timeline

  1. 30 Oct 2026, 13:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:45 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 16:00 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-116127
Disclosed
30 Oct 2026, 13:18 UTC
On Zero Radar
30 Oct 2026, 16:00 UTC (3 h after disclosure)
Last change
30 Oct 2026, 17:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Starlet web server for Perl sends unwanted data on HEAD requests · Zero Radar