Live › vulnerability › CVE-2026-115822
Go to dashboardStarman, a Perl PSGI web server, parses chunked request bodies with a regex that backtracks quadratically on a long run of hex digits followed by a bare LF. A remote attacker can tie up worker CPU by sending such a request to any route.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 17:42 UTC. All times on this page are UTC.
Teams running Starman directly as an internet-facing PSGI server for Perl applications are exposed, since any route that Starman serves can receive the crafted chunked body. Deployments where Starman sits behind a proxy that normalises or rejects chunked requests are likely less exposed, but the sources do not confirm this. Teams not running Starman can skip it.
No product ranges from the sources yet.
perl -MStarman -e 'print $Starman::VERSION' or cpanm --info Starman to read the installed versioncpanfile, cpanfile.snapshot or Makefile.PL for the deployed application0.4019 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^(([0-9a-fA-F]+).*\015\012)//. A line of hex digits followed by a bare LF and then CRLF never matches, because . does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.
A remote attacker can exhaust worker CPU by sending such requests to any route.
This page as .md · .json · in your agent: get_signal("CVE-2026-115822")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.