{"id":"CVE-2026-115866","kind":"vulnerability","aliases":["CVE-2026-115866"],"related":[],"title":"Starlet: chunked request parsing lets one request exhaust server CPU","description":"Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\n\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\n\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.","summary":"Starlet, a Perl web server, uses a regular expression to parse chunk-size lines in chunked request bodies. A crafted request with a long run of hex digits makes the matcher backtrack heavily, so an attacker can tie up a worker for about a minute of CPU time with one 128 KiB request.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","plack","self-hosted","starlet"],"not_affected_if":["no-chunked-input","version-0.33-or-later"],"how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'` or `cpanm --info Starlet`\n- Look in cpanfile, cpanfile.snapshot or Makefile.PL for a Starlet entry\n- Confirm whether the app is served by Starlet and accepts chunked request bodies from untrusted clients","fix":"- Starlet: move to `0.33` or later (the affected range is `0.20` before `0.33`)","status":"open","published_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:33+00:00","updated_at":"2026-10-30T13:32:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T13:32:33Z","model":"claude-haiku-5-5","output":{"fix":"- Starlet: move to `0.33` or later (the affected range is `0.20` before `0.33`)","reach":"internet","title":"Starlet: chunked request parsing lets one request exhaust server CPU","impact":"low","summary":"Starlet, a Perl web server, uses a regular expression to parse chunk-size lines in chunked request bodies. A crafted request with a long run of hex digits makes the matcher backtrack heavily, so an attacker can tie up a worker for about a minute of CPU time with one 128 KiB request.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","starlet","plack","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker ties up a worker process with one request","analyst_note":"","how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'` or `cpanm --info Starlet`\n- Look in cpanfile, cpanfile.snapshot or Makefile.PL for a Starlet entry\n- Confirm whether the app is served by Starlet and accepts chunked request bodies from untrusted clients","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.33-or-later","no-chunked-input"],"who_is_affected":"Applications served by Starlet versions from 0.20 up to but not including 0.33 that accept chunked request bodies from clients. The request is handled before the application code runs, so the app's own logic does not protect against it. Teams using a different server, or Starlet outside the affected range, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4215,"output_tokens":601,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115866':13A,16A '-2026':12A,15A '0.20':81C '0.33':83C '128':75B,179C 'allow':86C 'applic':184C 'attack':60B,165C 'backtrack':56B,92C 'bare':120C 'bodi':42B,97C 'call':186C 'chunk':2A,36B,40B,95C,100C 'chunk-siz':35B,99C 'cpu':10A,71B,87C,175C 'craft':44B 'crlf':114C,125C 'cve':11A,14A 'decod':94C 'digit':52B,110C,138C 'engin':131C 'exhaust':8A,88C 'express':32B,91C 'follow':117C 'grow':143C 'heavili':57B 'hex':51B,109C 'host':22B 'kib':76B,180C 'length':150C,154C 'let':5A 'lf':121C 'limit':152C 'line':38B,102C 'long':48B 'make':53B 'match':104C,128C,134C 'matcher':55B 'minut':69B,173C 'never':127C 'noth':151C 'occupi':167C 'one':6A,74B,178C 'packag':17B 'pars':4A,34B 'perl':18B,26B,85C 'plack':19B 'read':162C 'regular':31B,90C 'remot':164C 'request':3A,7A,41B,45B,77B,96C,181C 'retri':132C 'run':49B,107C,116C,149C,157C 'self':21B 'self-host':20B 'server':9A,28B 'sever':161C 'size':37B,101C 'span':160C 'squar':146C 'starlet':1A,23B,24B,78C 'taken':142C 'tie':62B 'time':72B,141C,176C 'use':29B 'version':79C 'via':89C 'web':27B 'worker':65B,169C","nicknames":[],"mitigations":[],"who_affected":"Applications served by Starlet versions from 0.20 up to but not including 0.33 that accept chunked request bodies from clients. The request is handled before the application code runs, so the app's own logic does not protect against it. Teams using a different server, or Starlet outside the affected range, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115866","severity":null,"published_at":"2026-10-30T13:18:31+00:00","modified_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}