Regular Expression Backtracking Vulnerability in Starlet for Perl

CVE-2026-115866

What is CVE-2026-115866?

Starlet for Perl contains a vulnerability that allows remote attackers to cause CPU exhaustion by exploiting regular expression backtracking when decoding chunked request bodies. Specifically, crafted requests can manipulate chunk-size lines, leading to extensive retries on the regex engine. This not only increases CPU time consumption significantly but can also render affected applications unresponsive, as each 128 KiB request can occupy a worker for an extended period. Mitigation includes upgrading to the patched version.

References