---
id: "CVE-2026-115822"
kind: "vulnerability"
aliases: ["CVE-2026-115822"]
title: "Starman: crafted chunked request body exhausts CPU through regex backtracking"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "perl", "self-hosted", "starman"]
not_affected_if: ["behind-proxy-normalising-chunked", "not-using-starman"]
published_at: "2026-10-25T17:17:01+00:00"
first_seen_at: "2026-10-25T17:42:01+00:00"
updated_at: "2026-10-25T17:43:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115822", "first_seen_at": "2026-10-25T17:42:01+00:00"}]
---

# Starman: crafted chunked request body exhausts CPU through regex backtracking

Starman, a Perl PSGI web server, parses chunked request bodies with a regex that backtracks quadratically on a long run of hex digits followed by a bare LF. A remote attacker can tie up worker CPU by sending such a request to any route.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman` to read the installed version
- Check the Starman version in `cpanfile`, `cpanfile.snapshot` or `Makefile.PL` for the deployed application

## Fix

- Upgrade Starman to `0.4019` or later
- Until upgraded, place a reverse proxy in front of Starman that limits request body or line length

## Timeline

- 2026-10-25T17:42:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115822

## From the sources

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.

Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.

A remote attacker can exhaust worker CPU by sending such requests to any route.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_