CVE-2026-115865 Details
Description
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.
A denial-of-service vulnerability has been identified in Starlet versions prior to 0.33 for Perl. The issue arises when a request is made with a large Content-Length, causing a worker to exhaust memory and crash. This happens because the request body is read in a loop that requests all of the remaining declared length at once. Perl increases the read buffer to match this size before any data is received, leading to an 'out of memory' error and forcing the worker to exit. A remote attacker can exploit this by sending requests with just a few bytes, causing repeated worker restarts.
Users can upgrade to Starlet version 0.33 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/KAZUHO/Starlet-0.33/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Starlet | < 0.33 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |