{"id":"CVE-2026-115817","kind":"vulnerability","aliases":["CVE-2026-115817"],"related":[],"title":"Starman: stalled request body holds every Perl worker, causing denial of service","description":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.","summary":"Starman, a Perl PSGI web server, reads request bodies with blocking reads and no deadline, so read_timeout only covers headers. A remote client that sends complete headers and then stalls the body can hold a worker indefinitely, and a few such connections exhaust the default worker pool.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","psgi","self-hosted","starman"],"not_affected_if":["proxy-with-body-timeouts","version-0.4019-or-later"],"how_to_check":"- Check the installed Starman version with `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman`\n- Confirm whether the server is exposed to untrusted clients directly rather than behind a proxy with body timeouts (unknown from the sources)","fix":"- Upgrade Starman to `0.4019` or later, which applies read_timeout to each body read and adds body_timeout (default 300 seconds)\n- Until upgraded, put a reverse proxy with request body timeouts in front of Starman (unknown from the sources)","status":"open","published_at":"2026-10-25T17:17:00+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","triaged_at":"2026-10-25T17:43:53+00:00","updated_at":"2026-10-25T17:43:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T17:43:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Starman to `0.4019` or later, which applies read_timeout to each body read and adds body_timeout (default 300 seconds)\n- Until upgraded, put a reverse proxy with request body timeouts in front of Starman (unknown from the sources)","reach":"internet","title":"Starman: stalled request body holds every Perl worker, causing denial of service","impact":"medium","summary":"Starman, a Perl PSGI web server, reads request bodies with blocking reads and no deadline, so read_timeout only covers headers. A remote client that sends complete headers and then stalls the body can hold a worker indefinitely, and a few such connections exhaust the default worker pool.","category":"package","nicknames":[],"who_cares":["perl","starman","psgi","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote clients stall requests and make the server stop answering","analyst_note":"","how_to_check":"- Check the installed Starman version with `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman`\n- Confirm whether the server is exposed to untrusted clients directly rather than behind a proxy with body timeouts (unknown from the sources)","needs_analyst":false,"not_affected_if":["version-0.4019-or-later","proxy-with-body-timeouts"],"who_is_affected":"Teams running Starman versions before 0.4019 as an HTTP server reachable from untrusted clients, including Perl PSGI apps served directly by Starman. Deployments where a proxy already limits body read time and connections are less exposed. The sources do not describe specific frameworks or configurations beyond the default worker count.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3418,"output_tokens":614,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115817':15A,18A '-2026':14A,17A '0.4019':77C,157C '300':173C 'add':168C 'allow':80C 'answer':154C 'appli':158C 'attack':134C 'block':36B,107C 'bodi':4A,34B,58B,84C,103C,124C,165C,170C,184C 'caus':9A 'chunk':101C 'client':49B,113C 'complet':52B,116C 'connect':68B,143C 'content':98C 'content-length':97C 'count':149C 'cover':45B,93C 'cve':13A,16A 'data':166C 'deadlin':40B,111C 'default':71B,147C,176C 'denial':10A 'disconnect':131C 'everi':6A,137C 'exhaust':69B 'five':144C 'header':46B,53B,96C,117C 'hold':5A,60B,86C 'host':24B 'indefinit':63B,89C 'keep':125C 'length':99C 'limit':172C 'packag':19B 'perl':7A,20B,28B,79C 'pool':73B 'psgi':21B,29B 'read':32B,37B,42B,91C,105C,108C,159C,182C 'remot':48B,133C 'request':3A,33B,83C,102C,155C 'second':174C 'self':23B 'self-host':22B 'send':51B,115C 'server':31B,152C 'servic':12A 'stall':2A,56B,82C,120C 'starman':1A,25B,26B,74C 'stop':153C 'take':136C 'time':180C 'timeout':43B,92C,160C,171C 'total':179C 'trickl':122C 'version':75C,156C 'wait':128C,163C 'web':30B 'worker':8A,62B,72B,88C,127C,138C,148C","nicknames":[],"mitigations":[],"who_affected":"Teams running Starman versions before 0.4019 as an HTTP server reachable from untrusted clients, including Perl PSGI apps served directly by Starman. Deployments where a proxy already limits body read time and connections are less exposed. The sources do not describe specific frameworks or configurations beyond the default worker count.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T17:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115817","severity":null,"published_at":"2026-10-25T17:17:00+00:00","modified_at":"2026-10-25T17:17:00+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","fetched_at":"2026-10-25T17:42:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}