CPU Exhaustion Vulnerability in Starman by Perl
CVE-2026-115822

Currently unrated

Key Information:

Status
Vendor
CVE Published:
25 October 2026

What is CVE-2026-115822?

The Starman web server for Perl is susceptible to a CPU exhaustion vulnerability when handling chunked request bodies. This arises from the way Starman decodes these bodies, utilizing a regex pattern that leads to exponential backtracking if the pattern does not match correctly. Remote attackers can exploit this by sending specially crafted requests, thereby causing significant CPU resource consumption and potentially leading to denial of service conditions. It is essential for users to upgrade to version 0.4019 or later to mitigate this risk.

References

https://github.com/miyagawa/Starman/commit/0f33f9b132b5e4...
patch
https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.