{"id":"CVE-2026-115865","kind":"vulnerability","aliases":["CVE-2026-115865"],"related":[],"title":"Starlet for Perl: oversized Content-Length request kills a worker by exhausting memory","description":"Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes.","summary":"Starlet, a Perl web server, reads a request body by asking for the full declared Content-Length at once, so a huge declared length makes Perl allocate that memory before any data arrives. An attacker sends a small request with a large Content-Length and repeatedly crashes the worker process.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","psgi","self-hosted","starlet"],"not_affected_if":["no-internet-exposure","non-starlet-server"],"how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'` or `cpanm --info Starlet`\n- Look in cpanfile, cpanfile.snapshot or Makefile.PL for a Starlet entry","fix":"- Starlet versions before `0.33` are affected; move to `0.33` or later","status":"open","published_at":"2026-10-30T13:18:30+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:36+00:00","updated_at":"2026-10-30T13:32:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T13:32:36Z","model":"claude-haiku-5-5","output":{"fix":"- Starlet versions before `0.33` are affected; move to `0.33` or later","reach":"internet","title":"Starlet for Perl: oversized Content-Length request kills a worker by exhausting memory","impact":"low","summary":"Starlet, a Perl web server, reads a request body by asking for the full declared Content-Length at once, so a huge declared length makes Perl allocate that memory before any data arrives. An attacker sends a small request with a large Content-Length and repeatedly crashes the worker process.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","starlet","psgi","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Repeated requests crash worker processes, causing denial of service","analyst_note":"","how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'` or `cpanm --info Starlet`\n- Look in cpanfile, cpanfile.snapshot or Makefile.PL for a Starlet entry\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["non-starlet-server","no-internet-exposure"],"who_is_affected":"Applications that run Starlet as their Perl PSGI web server and accept requests from the network are exposed, because the body is read before the application runs. Deployments behind a proxy that caps request body size, or that use another server, are less exposed; the sources do not say how much a proxy limits this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4169,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115865':17A,20A '-2026':16A,19A '0.33':83C 'alloc':55B 'allow':86C 'applic':154C 'arriv':61B,133C 'ask':38B,111C 'attack':63B,159C 'avail':139C 'bodi':36B,104C 'buffer':126C 'byte':171C 'call':156C 'content':6A,44B,72B,93C 'content-length':5A,43B,71B,92C 'crash':76B 'cve':15A,18A 'data':60B,132C 'declar':42B,51B,89C,118C 'error':151C 'exhaust':13A,100C 'exit':144C 'forc':161C 'full':41B 'grow':123C 'host':26B 'huge':50B 'kill':9A,96C 'larg':70B,91C 'larger':137C 'length':7A,45B,52B,73B,94C,119C,136C 'loop':109C 'make':53B,141C 'memori':14A,57B,101C,140C,150C 'overs':4A 'packag':21B 'perl':3A,22B,30B,54B,85C,122C 'process':79B 'psgi':23B 'read':33B,106C,125C 'remain':117C 'remot':158C 'repeat':75B 'request':8A,35B,67B,88C,103C,167C 'restart':164C 'self':25B 'self-host':24B 'send':64B 'server':32B 'size':129C 'small':66B 'starlet':1A,27B,28B,80C 'sysread':112C 'uncatch':147C 'version':81C 'web':31B 'worker':11A,78B,98C,143C,163C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Starlet as their Perl PSGI web server and accept requests from the network are exposed, because the body is read before the application runs. Deployments behind a proxy that caps request body size, or that use another server, are less exposed; the sources do not say how much a proxy limits this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115865","severity":null,"published_at":"2026-10-30T13:18:30+00:00","modified_at":"2026-10-30T13:18:30+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}