CVE-2026-40560 Details
Description
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
A vulnerability allowing HTTP request smuggling has been identified in Starman versions prior to 0.4018 for Perl. The issue arises from improper header precedence, where Starman incorrectly prioritizes 'Content-Length' over 'Transfer-Encoding: chunked' when both headers are present. According to RFC 7230 section 3.3.3, 'Transfer-Encoding' should take precedence. This vulnerability can be exploited to send malicious HTTP requests through a front-end reverse proxy.
Users can upgrade to Starman version 0.4018 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 | CPANSec | Third Party Advisory |
| https://github.com/miyagawa/Starman/commit/ced205f0805027e9d9c0731f8c40b104220604ed.patch | CPANSec | PatchThird Party Advisory |
| https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes | CPANSec | ProductRelease Notes |
| http://www.openwall.com/lists/oss-security/2026/04/29/1 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| miyagawa starman | < 0.4018 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | CVE Modified | CVE |
| Apr 29, 2026 | New CVE Received | CPANSec |