CVE-2026-115822
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Unknown product
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 0.4019CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^(([0-9a-fA-F]+).*\015\012)//. A line of hex digits followed by a bare LF and then CRLF never matches, because . does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.
A remote attacker can exhaust worker CPU by sending such requests to any route.
Text from CVE List
Affected versions 1
- Productaffected: all versions before 0.4019CVE List