CVE-2026-115817 Details

A denial-of-service vulnerability has been identified in Starman versions prior to 0.4019 for Perl. The issue arises because the server does not impose a timeout on reading the request body, allowing a client to send complete headers and then stall or trickle the body. This can hold a worker process indefinitely, as the read_timeout option only applies to headers. A remote attacker can exploit this by establishing multiple such connections, effectively tying up all available workers and causing the server to stop responding to requests.

Users can upgrade to Starman version 0.4019 or later, where this vulnerability has been addressed by introducing a body_timeout option that limits the total time allowed for reading request bodies. This version also applies the read_timeout option to each wait for body data, preventing slow clients from holding up worker processes.