Live › vulnerability › CVE-2026-115865
Starlet, a Perl web server, reads a request body by asking for the full declared Content-Length at once, so a huge declared length makes Perl allocate that memory before any data arrives. An attacker sends a small request with a large Content-Length and repeatedly crashes the worker process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Applications that run Starlet as their Perl PSGI web server and accept requests from the network are exposed, because the body is read before the application runs. Deployments behind a proxy that caps request body size, or that use another server, are less exposed; the sources do not say how much a proxy limits this.
No product ranges from the sources yet.
perl -MStarlet -e 'print $Starlet::VERSION' or cpanm --info Starlet0.33 are affected; move to 0.33 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.
The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
This page as .md · .json · in your agent: get_signal("CVE-2026-115865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.