CVE-2026-116127 Details
Description
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body. Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.
A vulnerability exists in Starlet versions prior to 0.33 for Perl, where the server incorrectly sends response bodies for HEAD requests. This issue can corrupt subsequent responses on persistent or pipelined connections. The response method is not properly managed, leading to unintended body content being sent. With the Plack::Middleware::Head, the body is empty, but the HTTP/1.1 response lacks a Content-Length header, causing the chunked encoding terminator to be sent instead. Additionally, responses with status codes 204 or 304 improperly include a body. This vulnerability can desynchronize proxies that share connections across clients, as pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default.
Users can upgrade to Starlet version 0.33 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kazuho/Starlet/commit/859e0c9572cdbed4bb45706d3957b3c025dc0ede.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/KAZUHO/Starlet-0.33/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Starlet | < 0.33 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |