CVE-2026-40561 Details
Description
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
A vulnerability in Starlet versions prior to 0.31 for Perl allows HTTP request smuggling through improper header precedence. Starlet incorrectly prioritizes 'Content-Length' over 'Transfer-Encoding: chunked' when both headers are present, contrary to RFC 7230, which states that 'Transfer-Encoding' must take precedence. This flaw could enable an attacker to smuggle malicious HTTP requests through a front-end reverse proxy.
Users can update to Starlet version 0.31 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 | CPANSec | Third Party Advisory |
| https://github.com/kazuho/Starlet/commit/a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0.patch | CPANSec | Patch |
| https://metacpan.org/release/KAZUHO/Starlet-0.32/changes | CPANSec | |
| http://www.openwall.com/lists/oss-security/2026/05/03/1 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| kazuho starlet | <= 0.31 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| May 7, 2026 | CVE Modified | CPANSec |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | CVE Modified | CISA-ADP |
| May 3, 2026 | CVE Modified | CVE |
| May 3, 2026 | New CVE Received | CPANSec |