{"id":"CVE-2026-116127","kind":"vulnerability","aliases":["CVE-2026-116127"],"related":[],"title":"Starlet for Perl: HEAD responses carry a body, desyncing pipelined connections","description":"Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection.\n\nThe request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body.\n\nPipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.","summary":"Starlet, a Perl web server, sends a response body to HEAD requests and to 204 and 304 responses. On persistent or pipelined connections the extra bytes corrupt the next response, which can desynchronize a proxy shared across clients.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","plack","self-hosted","starlet"],"not_affected_if":["no-shared-proxy-connections","starlet-0.33-or-later"],"how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'`\n- Look for `Starlet` in the cpanfile, cpanfile.snapshot or Makefile.PL of the application\n- Confirm whether a reverse proxy sits in front of the Perl app and shares connections across clients","fix":"- Starlet: `0.33` or later (the fix is in versions before 0.33 per the NVD description)","status":"open","published_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:32+00:00","updated_at":"2026-10-30T13:32:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T13:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Starlet: `0.33` or later (the fix is in versions before 0.33 per the NVD description)","reach":"network","title":"Starlet for Perl: HEAD responses carry a body, desyncing pipelined connections","impact":"low","summary":"Starlet, a Perl web server, sends a response body to HEAD requests and to 204 and 304 responses. On persistent or pipelined connections the extra bytes corrupt the next response, which can desynchronize a proxy shared across clients.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","starlet","plack","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Response corruption that can desynchronize a shared proxy connection across clients","analyst_note":"","how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'`\n- Look for `Starlet` in the cpanfile, cpanfile.snapshot or Makefile.PL of the application\n- Confirm whether a reverse proxy sits in front of the Perl app and shares connections across clients","plain_action":"","needs_analyst":false,"not_affected_if":["starlet-0.33-or-later","no-shared-proxy-connections"],"who_is_affected":"Applications running Starlet below 0.33 are affected, most risky when a proxy or load balancer reuses persistent or pipelined connections to the Perl app across different clients. Standalone use with a single client and no shared proxy path is lower risk. Apps that do not use Starlet can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000721,"input_tokens":4262,"output_tokens":589,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116127':14A,17A '-2026':13A,16A '0.33':66C '204':39B,136C '304':41B,138C 'across':61B,192C 'aliv':158C 'also':140C 'applic':101C 'bodi':8A,33B,71C,99C,114C,144C 'byte':50B,175C 'carri':6A 'chunk':130C 'client':62B,166C,193C 'connect':11A,47B,86C,152C,171C,191C 'content':124C 'content-length':123C 'corrupt':51B,77C 'cve':12A,15A 'default':164C 'desync':9A 'desynchron':57B,185C 'disabl':160C 'empti':116C 'encod':131C 'even':154C 'extra':49B,174C 'get':128C,146C 'head':4A,35B,75C,105C,112C,148C 'header':126C 'host':23B 'http/1.1':119C 'keep':150C,157C 'keep-al':156C 'length':125C 'may':184C 'method':89C 'middlewar':111C 'next':53B,79C,181C 'open':153C 'packag':18B 'pass':92C 'perl':3A,19B,27B,68C 'persist':44B,83C 'pipelin':10A,46B,85C,145C 'plack':20B,110C 'proxi':59B,168C,187C 'read':169C 'request':36B,76C,88C,106C,149C 'respons':5A,32B,42B,54B,73C,80C,95C,120C,133C,182C 'return':102C 'self':22B 'self-host':21B 'send':30B,69C 'sent':108C,141C 'server':29B 'share':60B,189C 'starlet':1A,24B,25B,63C 'start':178C 'status':135C 'still':127C 'take':172C 'termin':132C 'version':64C 'web':28B 'whatev':98C 'without':121C 'writer':96C","nicknames":[],"mitigations":[],"who_affected":"Applications running Starlet below 0.33 are affected, most risky when a proxy or load balancer reuses persistent or pipelined connections to the Perl app across different clients. Standalone use with a single client and no shared proxy path is lower risk. Apps that do not use Starlet can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116127","severity":null,"published_at":"2026-10-30T13:18:31+00:00","modified_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}