---
id: "CVE-2026-116127"
kind: "vulnerability"
aliases: ["CVE-2026-116127"]
title: "Starlet for Perl: HEAD responses carry a body, desyncing pipelined connections"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "perl", "plack", "self-hosted", "starlet"]
not_affected_if: ["no-shared-proxy-connections", "starlet-0.33-or-later"]
published_at: "2026-10-30T13:18:31+00:00"
first_seen_at: "2026-10-30T13:30:27+00:00"
updated_at: "2026-10-30T13:32:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116127", "first_seen_at": "2026-10-30T13:30:27+00:00"}]
---

# Starlet for Perl: HEAD responses carry a body, desyncing pipelined connections

Starlet, a Perl web server, sends a response body to HEAD requests and to 204 and 304 responses. On persistent or pipelined connections the extra bytes corrupt the next response, which can desynchronize a proxy shared across clients.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'`
- Look for `Starlet` in the cpanfile, cpanfile.snapshot or Makefile.PL of the application
- Confirm whether a reverse proxy sits in front of the Perl app and shares connections across clients

## Fix

- Starlet: `0.33` or later (the fix is in versions before 0.33 per the NVD description)

## Timeline

- 2026-10-30T13:30:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116127

## From the sources

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection.

The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body.

Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_