CVE-2026-115817

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as readtimeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the...

EUVD-2026-109558

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as readtimeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the...

CVE-2026-115817 Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as readtimeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the...

CVE-2026-115817

Starman versions prior to 0.4019 for Perl are vulnerable to a denial-of-service condition because Content-Length and chunked request bodies are processed using blocking reads without a deadline. While read_timeout covers headers, a client can stall or slowly trickle the request body to hold a wor...