{"schema":"threatline.record/2","record":{"id":"CVE-2026-115817","aliases":[],"summary":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers","details":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115817","source_modified_at":"2026-10-25T16:50:33.914Z","fetched_at":"2026-10-25T18:55:31.805249Z","product":null,"vendor":null,"versions":[{"lessThan":"0.4019","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115817","source_modified_at":"2026-10-25T16:50:33.914Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"name":null,"ecosystem":null},"version":"0.4019","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-25T16:50:33.914Z","modified_at":"2026-10-25T16:50:33.914Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115817","fetched_at":"2026-10-25T18:55:31.805249Z","source_modified_at":"2026-10-25T16:50:33.914Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch","tags":["patch"]},{"source":"CVE List","url":"https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-25T16:50:33.914Z","content_hash":"0c59da386e441588809dbd1795bfd15770d71197c41b45b1af685bfd927d536d"}}