92 matches found
CVE-2026-115823
A flaw was found in Starman. The web server improperly sends message bodies for HTTP responses that should contain headers only, such as HEAD requests and certain status codes. A remote attacker can exploit this behavior over persistent connections to cause HTTP response desynchronization between...
FreeBSD : p5-Starman -- multiple vulnerabilities (d8b29eb8-d2d8-11f1-97dc-40b034429ecf)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d8b29eb8-d2d8-11f1-97dc-40b034429ecf advisory. Starman project reports: SECURITY Tenable has extracted the preceding description block direct...
CVE-2026-115824
A flaw was found in Starman. The chunked request body decoder does not properly limit chunk sizes or line lengths, leading to unbounded memory buffering. A remote attacker can exploit this vulnerability by sending streaming chunked requests, exhausting server memory and causing a Denial of Servic...
CVE-2026-115817
A flaw was found in Starman. A remote attacker can cause a Denial of Service DoS by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked...
SUSE CVE-2026-115817
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as readtimeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the...
SUSE CVE-2026-115822
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^0-9a-fA-F+.\015\012//. A line of hex digits followed by a...
SUSE CVE-2026-115823
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...
SUSE CVE-2026-115824
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...
OPENSUSE-SU-2026:12276-1 perl-Starman-0.4019-1.1 on GA media
These are all security issues fixed in the perl-Starman-0.4019-1.1 package on the GA media of openSUSE Tumbleweed...
Linux Distros Unpatched Vulnerability : CVE-2026-115822
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked reque...
PT-2026-127771
These are all security issues fixed in the perl-Starman-0.4019-1.1 package on the GA media of openSUSE Tumbleweed...
Linux Distros Unpatched Vulnerability : CVE-2026-115824
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in...
Linux Distros Unpatched Vulnerability : CVE-2026-115817
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as readtimeout covers only the headers. Content-Length and...
Linux Distros Unpatched Vulnerability : CVE-2026-115823
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman...
UBUNTU-CVE-2026-115817
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as readtimeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the...
UBUNTU-CVE-2026-115822
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^0-9a-fA-F+.\015\012//. A line of hex digits followed by a...
UBUNTU-CVE-2026-115824
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...
DEBIAN-CVE-2026-115824
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...
CVE-2026-115823
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...
DEBIAN-CVE-2026-115823
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...