{"schema":"threatline.record/2","record":{"id":"CVE-2026-115823","aliases":[],"summary":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections","details":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.","categories":["Libraries & packages"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115823","source_modified_at":"2026-10-25T16:51:19.961Z","fetched_at":"2026-10-25T18:55:31.805249Z","product":null,"vendor":null,"versions":[{"lessThan":"0.4019","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115823","source_modified_at":"2026-10-25T16:51:19.961Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"name":null,"ecosystem":null},"version":"0.4019","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-25T16:51:19.961Z","modified_at":"2026-10-25T16:51:19.961Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115823","fetched_at":"2026-10-25T18:55:31.805249Z","source_modified_at":"2026-10-25T16:51:19.961Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"summary-specific-product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-25T16:51:19.961Z","content_hash":"c422e13f4eddc775ca4560ab5a5dd1e4a3e178b6492207a1c7fb830d70f44a4b"}}