Live › vulnerability › CVE-2026-115817
Go to dashboardStarman, a Perl PSGI web server, reads request bodies with blocking reads and no deadline, so read_timeout only covers headers. A remote client that sends complete headers and then stalls the body can hold a worker indefinitely, and a few such connections exhaust the default worker pool.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 17:42 UTC. All times on this page are UTC.
Teams running Starman versions before 0.4019 as an HTTP server reachable from untrusted clients, including Perl PSGI apps served directly by Starman. Deployments where a proxy already limits body read time and connections are less exposed. The sources do not describe specific frameworks or configurations beyond the default worker count.
No product ranges from the sources yet.
perl -MStarman -e 'print $Starman::VERSION' or cpanm --info Starman0.4019 or later, which applies read_timeout to each body read and adds body_timeout (default 300 seconds)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.
Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.
A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.
Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
This page as .md · .json · in your agent: get_signal("CVE-2026-115817")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.