Live › vulnerability › CVE-2026-116128
Starlet, a Perl PSGI web server, buffers chunked request bodies without limit when a chunk-size line never ends. A remote client can make a worker run out of memory with a single request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams running a Perl web application on Starlet versions from 0.20 up to but not including 0.33, especially if the server accepts requests from the internet. Applications behind a proxy that buffers or limits request bodies, or that run other servers, are less exposed; the sources do not say how much a proxy would reduce the risk.
No product ranges from the sources yet.
perl -MStarlet -e 'print $Starlet::VERSION' or cpanm --info Starlet.cpanfile, cpanfile.snapshot or Makefile.PL of any Perl web app.0.20 before 0.33 are affected; move to 0.33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.
The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.
A remote attacker can exhaust a worker's memory with a single request.
This page as .md · .json · in your agent: get_signal("CVE-2026-116128")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.