---
id: "CVE-2026-115823"
kind: "vulnerability"
aliases: ["CVE-2026-115823"]
title: "Starman for Perl: HEAD responses carry bodies, desyncing keep-alive connections"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["perl", "reverse-proxy", "runtime", "self-hosted", "starman"]
not_affected_if: ["not-using-starman", "patched-version"]
published_at: "2026-10-25T17:17:01+00:00"
first_seen_at: "2026-10-25T17:42:01+00:00"
updated_at: "2026-10-25T17:43:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115823", "first_seen_at": "2026-10-25T17:42:01+00:00"}]
---

# Starman for Perl: HEAD responses carry bodies, desyncing keep-alive connections

Starman, a Perl PSGI web server, writes the response body for HEAD requests and for 1xx, 204 and 304 responses on keep-alive connections. The client then reads those extra bytes as the start of its next response, so a proxy that reuses connections can pair responses with the wrong requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Starman version with `perl -MStarman -e 'print $Starman::VERSION'` or `cpanm --info Starman`
- Look for a reverse proxy in front of Starman that reuses upstream connections (keepalive to the backend)

## Fix

- Upgrade Starman to `0.4019` or later
- unknown whether a workaround exists short of upgrading

## Timeline

- 2026-10-25T17:42:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115823

## From the sources

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.

For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.

On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_