Memory Exhaustion in Starlet for Perl Affects Multiple Versions

CVE-2026-116128

What is CVE-2026-116128?

A memory exhaustion vulnerability exists in Starlet, a web server for Perl, affecting versions prior to 0.33. The vulnerability arises from unbounded buffering while decoding chunked request bodies. Due to the lack of constraints on the length of chunk-size lines, a remote attacker can send a carefully crafted request that continuously grows the buffer without limits, leading to memory exhaustion on the server. This can occur with a single malicious request, causing significant resource depletion and potentially impacting the availability of the affected services.

References