{"id":"CVE-2026-116128","kind":"vulnerability","aliases":["CVE-2026-116128"],"related":[],"title":"Starlet (Perl): unbounded chunked request buffering exhausts server memory","description":"Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.\n\nThe decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.\n\nA remote attacker can exhaust a worker's memory with a single request.","summary":"Starlet, a Perl PSGI web server, buffers chunked request bodies without limit when a chunk-size line never ends. A remote client can make a worker run out of memory with a single request.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","psgi","self-hosted","starlet"],"not_affected_if":["no-internet-exposure","not-starlet","version-0.33-or-later"],"how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'` or `cpanm --info Starlet`.\n- Look for Starlet in `cpanfile`, `cpanfile.snapshot` or `Makefile.PL` of any Perl web app.\n- Confirm whether the app is reachable from the internet and accepts chunked request bodies.","fix":"- Starlet versions from `0.20` before `0.33` are affected; move to `0.33` or later.","status":"open","published_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:32+00:00","updated_at":"2026-10-30T13:32:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T13:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Starlet versions from `0.20` before `0.33` are affected; move to `0.33` or later.","reach":"internet","title":"Starlet (Perl): unbounded chunked request buffering exhausts server memory","impact":"medium","summary":"Starlet, a Perl PSGI web server, buffers chunked request bodies without limit when a chunk-size line never ends. A remote client can make a worker run out of memory with a single request.","audience":"businesses","category":"package","nicknames":[],"who_cares":["perl","starlet","psgi","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"remote client exhausts worker memory, denying service to the application","analyst_note":"","how_to_check":"- Check the installed Starlet version with `perl -MStarlet -e 'print $Starlet::VERSION'` or `cpanm --info Starlet`.\n- Look for Starlet in `cpanfile`, `cpanfile.snapshot` or `Makefile.PL` of any Perl web app.\n- Confirm whether the app is reachable from the internet and accepts chunked request bodies.","plain_action":"","needs_analyst":false,"not_affected_if":["not-starlet","version-0.33-or-later","no-internet-exposure"],"who_is_affected":"Teams running a Perl web application on Starlet versions from 0.20 up to but not including 0.33, especially if the server accepts requests from the internet. Applications behind a proxy that buffers or limits request bodies, or that run other servers, are less exposed; the sources do not say how much a proxy would reduce the risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4205,"output_tokens":594,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116128':12A,15A '-2026':11A,14A '0.20':61C '0.33':63C 'add':79C 'allow':66C 'also':130C 'arriv':140C 'attack':143C 'bodi':32B,76C 'buffer':6A,29B,71C,84C,106C,134C 'chunk':4A,30B,38B,74C,95C,128C,138C 'chunk-siz':37B,94C 'client':45B,112C 'crlf':103C 'cve':10A,13A 'data':124C 'decod':73C,78C 'end':42B 'everi':121C 'exhaust':7A,68C,145C 'grow':104C 'held':131C 'host':21B 'input':87C 'keep':113C 'larg':127C 'length':91C 'limit':34B,89C 'line':40B,97C,100C 'long':109C 'make':47B 'memori':9A,53B,67C,149C 'never':41B 'noth':88C 'one':83C 'packag':16B 'perl':2A,17B,25B,65C 'psgi':18B,26B 'read':81C,117C,122C 'remot':44B,142C 'request':5A,31B,57B,75C,153C 'restart':119C 'run':50B 'self':20B 'self-host':19B 'send':114C 'server':8A,28B 'singl':56B,152C 'size':39B,96C 'starlet':1A,22B,23B,58C 'timeout':118C 'unbound':3A,70C 'unconsum':86C 'version':59C 'via':69C 'web':27B 'whole':137C 'without':33B,101C 'worker':49B,147C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Perl web application on Starlet versions from 0.20 up to but not including 0.33, especially if the server accepts requests from the internet. Applications behind a proxy that buffers or limits request bodies, or that run other servers, are less exposed; the sources do not say how much a proxy would reduce the risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T13:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116128","severity":null,"published_at":"2026-10-30T13:18:31+00:00","modified_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}