Memory Exhaustion Vulnerability in Starman by MIYAGAWA

CVE-2026-115824

What is CVE-2026-115824?

Starman versions prior to 0.4019 for Perl are vulnerable to a memory exhaustion issue caused by unbounded buffering of chunked request bodies. The chunked body decoder retains each chunk in memory until the entire chunk, along with its CRLF, is received. This vulnerability allows a remote attacker to exploit the system by sending a chunk-size declaration that is excessively large or by continuously providing chunk-size lines without termination. Consequently, as the attacker streams data, the buffer grows indefinitely, leading to the exhaustion of worker memory with just a single connection.

References