Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.
A remote attacker can exhaust worker memory with a single connection.
The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.
A remote attacker can exhaust worker memory with a single connection.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to Starman 0.4019 or later.
Workaround
No workaround given by the vendor.
References
History
Sun, 25 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending. A remote attacker can exhaust worker memory with a single connection. | |
| Title | Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies | |
| Weaknesses | CWE-770 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-25T16:51:39.510Z
Reserved: 2026-10-23T16:47:20.192Z
Link: CVE-2026-115824
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-25T17:17:01.853
Modified: 2026-10-25T17:17:01.853
Link: CVE-2026-115824
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses