Live › vulnerability › CVE-2026-115866
Starlet, a Perl web server, uses a regular expression to parse chunk-size lines in chunked request bodies. A crafted request with a long run of hex digits makes the matcher backtrack heavily, so an attacker can tie up a worker for about a minute of CPU time with one 128 KiB request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Applications served by Starlet versions from 0.20 up to but not including 0.33 that accept chunked request bodies from clients. The request is handled before the application code runs, so the app's own logic does not protect against it. Teams using a different server, or Starlet outside the affected range, can skip it.
No product ranges from the sources yet.
perl -MStarlet -e 'print $Starlet::VERSION' or cpanm --info Starlet0.33 or later (the affected range is 0.20 before 0.33)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.
A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.
A remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.
This page as .md · .json · in your agent: get_signal("CVE-2026-115866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.