{"id":"CVE-2026-115823","kind":"vulnerability","aliases":["CVE-2026-115823"],"related":[],"title":"Starman for Perl: HEAD responses carry bodies, desyncing keep-alive connections","description":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.","summary":"Starman, a Perl PSGI web server, writes the response body for HEAD requests and for 1xx, 204 and 304 responses on keep-alive connections. The client then reads those extra bytes as the start of its next response, so a proxy that reuses connections can pair responses with the wrong requests.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["perl","reverse-proxy","runtime","self-hosted","starman"],"not_affected_if":["not-using-starman","patched-version"],"how_to_check":"- Check the installed Starman version with `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman`\n- Look for a reverse proxy in front of Starman that reuses upstream connections (keepalive to the backend)","fix":"- Upgrade Starman to `0.4019` or later\n- unknown whether a workaround exists short of upgrading","status":"open","published_at":"2026-10-25T17:17:01+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","triaged_at":"2026-10-25T17:43:49+00:00","updated_at":"2026-10-25T17:43:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T17:43:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Starman to `0.4019` or later\n- unknown whether a workaround exists short of upgrading","reach":"internet","title":"Starman for Perl: HEAD responses carry bodies, desyncing keep-alive connections","impact":"medium","summary":"Starman, a Perl PSGI web server, writes the response body for HEAD requests and for 1xx, 204 and 304 responses on keep-alive connections. The client then reads those extra bytes as the start of its next response, so a proxy that reuses connections can pair responses with the wrong requests.","category":"runtime","nicknames":[],"who_cares":["perl","starman","self-hosted","reverse-proxy"],"confidence":0.6,"needs_auth":"no","worst_case":"response desync lets one user receive another user's responses","analyst_note":"Check the NVD entry and the Starman changelog for the 0.4019 fix and whether a proxy-side mitigation is documented.","how_to_check":"- Check the installed Starman version with `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman`\n- Look for a reverse proxy in front of Starman that reuses upstream connections (keepalive to the backend)","needs_analyst":true,"not_affected_if":["not-using-starman","patched-version"],"who_is_affected":"Systems running Starman versions before 0.4019 as a web server, especially behind a front-end proxy that keeps connections open to the backend. Standalone Starman serving direct clients without a connection-reusing proxy is less exposed, though the sources do not say this removes the risk. Teams not running Starman for Perl can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3384,"output_tokens":603,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115823':15A,18A '-2026':14A,17A '0.4019':83C '1xx':43B,127C '204':44B,128C '304':46B,130C 'aliv':11A,51B,97C,140C 'also':132C 'applic':115C 'array':119C 'bodi':7A,37B,88C,111C,135C 'byte':59B,148C 'carri':6A,133C 'chunk':105C 'client':54B,145C 'connect':12A,52B,72B,98C,143C,164C 'cve':13A,16A 'desync':8A 'desynchron':92C 'end':159C 'extra':58B 'frame':106C 'front':158C 'front-end':157C 'head':4A,39B,90C,101C 'host':26B 'keep':10A,50B,96C,139C 'keep-al':9A,49B,95C,138C 'may':165C 'next':65B,154C 'omit':104C 'pair':74B,167C 'path':123C 'perl':3A,19B,30B,85C 'pipelin':142C 'proxi':22B,69B,160C 'psgi':31B 'read':56B,146C 'request':40B,79B,91C,102C,172C 'respons':5A,36B,47B,66B,75B,87C,93C,122C,124C,155C,168C 'return':112C 'reus':71B,162C 'revers':21B 'reverse-proxi':20B 'runtim':23B 'self':25B 'self-host':24B 'send':86C 'server':33B 'starman':1A,27B,28B,80C,103C 'start':62B,151C 'status':131C 'still':108C 'stream':121C 'upstream':163C 'version':81C 'web':32B 'write':34B,109C 'wrong':78B,171C","nicknames":[],"mitigations":[],"who_affected":"Systems running Starman versions before 0.4019 as a web server, especially behind a front-end proxy that keeps connections open to the backend. Standalone Starman serving direct clients without a connection-reusing proxy is less exposed, though the sources do not say this removes the risk. Teams not running Starman for Perl can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T17:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115823","severity":null,"published_at":"2026-10-25T17:17:01+00:00","modified_at":"2026-10-25T17:17:01+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","fetched_at":"2026-10-25T17:42:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}