CVE-2026-115824 Details

A memory exhaustion vulnerability has been identified in Starman versions prior to 0.4019 for Perl. This issue arises from unbounded buffering of chunked request bodies, allowing a remote attacker to exhaust worker memory using a single connection. The chunked body decoder retains each chunk in memory until the entire chunk, along with its CRLF termination, has been received. There is no limit on the length of the chunk-size line, enabling clients to declare excessively large chunk sizes or send indefinite chunk-size lines, leading to uncontrolled memory consumption.

Users can upgrade to Starman version 0.4019 or later, where this vulnerability has been fixed.