{"id":"CVE-2026-115822","kind":"vulnerability","aliases":["CVE-2026-115822"],"related":[],"title":"Starman: crafted chunked request body exhausts CPU through regex backtracking","description":"Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nStarman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\\015\\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.\n\nA remote attacker can exhaust worker CPU by sending such requests to any route.","summary":"Starman, a Perl PSGI web server, parses chunked request bodies with a regex that backtracks quadratically on a long run of hex digits followed by a bare LF. A remote attacker can tie up worker CPU by sending such a request to any route.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","self-hosted","starman"],"not_affected_if":["behind-proxy-normalising-chunked","not-using-starman"],"how_to_check":"- `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman` to read the installed version\n- Check the Starman version in `cpanfile`, `cpanfile.snapshot` or `Makefile.PL` for the deployed application","fix":"- Upgrade Starman to `0.4019` or later\n- Until upgraded, place a reverse proxy in front of Starman that limits request body or line length","status":"open","published_at":"2026-10-25T17:17:01+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","triaged_at":"2026-10-25T17:43:53+00:00","updated_at":"2026-10-25T17:43:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T17:43:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Starman to `0.4019` or later\n- Until upgraded, place a reverse proxy in front of Starman that limits request body or line length","reach":"internet","title":"Starman: crafted chunked request body exhausts CPU through regex backtracking","impact":"low","summary":"Starman, a Perl PSGI web server, parses chunked request bodies with a regex that backtracks quadratically on a long run of hex digits followed by a bare LF. A remote attacker can tie up worker CPU by sending such a request to any route.","category":"package","nicknames":[],"who_cares":["perl","starman","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker exhausts worker CPU, causing denial of service","analyst_note":"Confirm the exact affected range and fixed version from the NVD entry and the Starman changelog; the sources give only 'before 0.4019'.","how_to_check":"- `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman` to read the installed version\n- Check the Starman version in `cpanfile`, `cpanfile.snapshot` or `Makefile.PL` for the deployed application","needs_analyst":true,"not_affected_if":["not-using-starman","behind-proxy-normalising-chunked"],"who_is_affected":"Teams running Starman directly as an internet-facing PSGI server for Perl applications are exposed, since any route that Starman serves can receive the crafted chunked body. Deployments where Starman sits behind a proxy that normalises or rejects chunked requests are likely less exposed, but the sources do not confirm this. Teams not running Starman can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000651,"input_tokens":3423,"output_tokens":618,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115822':13A,16A '-2026':12A,15A '-9':103C '0':102C '0.4019':70C '012':109C '015':108C 'a-fa-f':104C 'allow':73C 'applic':93C 'attack':53B,154C 'attempt':133C 'backtrack':10A,37B,79C,134C 'bare':49B,118C 'bodi':5A,32B,84C,89C 'call':91C 'chunk':3A,30B,82C,87C,97C 'chunk-siz':96C 'cpu':7A,58B,74C,158C 'craft':2A 'crlf':122C 'cve':11A,14A 'decod':86C 'digit':45B,114C 'exhaust':6A,75C,156C 'f':107C 'fa':106C 'fail':132C 'follow':46B,115C 'hex':44B,113C,143C 'host':21B 'length':140C,148C 'lf':50B,119C,129C 'limit':146C 'line':99C,111C,151C 'long':41B 'match':94C,124C,128C 'never':123C 'noth':145C 'packag':17B 'pars':29B,81C 'perl':18B,25B,72C 'psgi':26B 'quadrat':38B,77C,137C 'regex':9A,35B,78C 'remot':52B,153C 'request':4A,31B,63B,83C,88C,162C 'rout':66B,165C 'run':42B,144C 'self':20B 'self-host':19B 'send':60B,160C 'server':28B 'size':98C 'starman':1A,22B,23B,67C,85C 'tie':55B 'time':136C 'version':68C 'via':76C 'web':27B 'worker':57B,157C","nicknames":[],"mitigations":[],"who_affected":"Teams running Starman directly as an internet-facing PSGI server for Perl applications are exposed, since any route that Starman serves can receive the crafted chunked body. Deployments where Starman sits behind a proxy that normalises or rejects chunked requests are likely less exposed, but the sources do not confirm this. Teams not running Starman can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T17:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115822","severity":null,"published_at":"2026-10-25T17:17:01+00:00","modified_at":"2026-10-25T17:17:01+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","fetched_at":"2026-10-25T17:42:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}