CVE-2026-40560

The Starman PSGI Perl web server (versions before 0.4018 ) is vulnerable to HTTP Request Smuggling due to Improper Header Precedence . The software incorrectly prioritizes the Content-Length header over Transfer-Encoding: chunked when both are present in an HTTP request, violating RFC 7230 3.3.3 ...