EUVD-2026-109559

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^0-9a-fA-F+.\015\012//. A line of hex digits followed by a...