Response Body Mismanagement in Starman by Perl
CVE-2026-115823

Currently unrated

Key Information:

Status
Vendor
CVE Published:
25 October 2026

What is CVE-2026-115823?

In Starman versions earlier than 0.4019, a flaw exists in the handling of HEAD requests which allows the inclusion of response bodies incorrectly. This desynchronization can lead to a scenario where response data is misaligned with requests when using keep-alive connections, potentially exposing applications to data leakage or erroneous client-server interactions. The vulnerability emerges because Starman does not utilize chunked response framing for HEAD requests while still transmitting the application’s body, which can confuse clients and proxies that expect responses to adhere to standard protocols.

References

https://github.com/miyagawa/Starman/commit/91c47c529cd1e1...
patch
https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.