Live › vulnerability › CVE-2026-115823
Go to dashboardStarman, a Perl PSGI web server, writes the response body for HEAD requests and for 1xx, 204 and 304 responses on keep-alive connections. The client then reads those extra bytes as the start of its next response, so a proxy that reuses connections can pair responses with the wrong requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 17:42 UTC. All times on this page are UTC.
Systems running Starman versions before 0.4019 as a web server, especially behind a front-end proxy that keeps connections open to the backend. Standalone Starman serving direct clients without a connection-reusing proxy is less exposed, though the sources do not say this removes the risk. Teams not running Starman for Perl can skip it.
No product ranges from the sources yet.
perl -MStarman -e 'print $Starman::VERSION' or cpanm --info Starman0.4019 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.
For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.
On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-115823")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.