CVE-2026-115823 Details
Description
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
A vulnerability exists in Starman versions prior to 0.4019 for Perl, where the server incorrectly sends response bodies for HEAD requests. This behavior disrupts the expected response handling on keep-alive connections. Although Starman stopped adding chunked framing to HEAD responses in version 0.4009, it continued to transmit the body generated by the application, regardless of the response type. As a result, on a keep-alive or pipelined connection, the client may misinterpret these body bytes as the beginning of a new response. This issue can lead to response desynchronization, especially when a front-end proxy reuses upstream connections.
Users can upgrade to Starman version 0.4019 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Starman | < 0.4019 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | CPANSec |