Denial of Service Vulnerability in Starman by Perl

CVE-2026-115817

What is CVE-2026-115817?

The Starman web server for Perl is susceptible to a denial of service vulnerability due to the handling of request bodies. In versions prior to 0.4019, a stalled request body can cause a worker to hang indefinitely since the read_timeout only applies to headers. This allows a remote attacker to exploit the server by sending complete headers while deliberately delaying the body, causing workers to become unresponsive. With the default worker configuration, an attacker can incapacitate all workers using just a handful of such connections. The upgrade to version 0.4019 implements a body_timeout limit of 300 seconds, effectively mitigating this issue by applying read_timeouts to wait periods for body data.

References