CVE-2026-116128 Details

A memory exhaustion vulnerability has been identified in Starlet versions 0.20 prior to 0.33 for Perl. The issue arises from unbounded buffering in the chunked request body decoder, which allows a remote attacker to exhaust a worker's memory with a single request. The decoder accumulates unconsumed input in a single buffer without limiting the length of chunk-size lines. This flaw enables the buffer to grow indefinitely as long as the client continues sending data, while the read timeout resets after each read. Additionally, the decoder retains large chunk data in the buffer until the entire chunk is received.

Users can upgrade to Starlet version 0.33 or later, where this vulnerability has been addressed.