CVE-2026-115822 Details
Description
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.
A denial-of-service vulnerability has been identified in Starman versions prior to 0.4019 for Perl. The issue arises from quadratic regex backtracking during the parsing of chunked request bodies. Starman decodes these bodies before passing them to the application, using a regex that fails to match certain valid chunk-size lines, leading to excessive CPU consumption. A remote attacker can exploit this by sending specially crafted chunked requests, causing significant CPU exhaustion on the server.
Users can upgrade to Starman version 0.4019 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Starman | < 0.4019 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | CPANSec |