CVE-2026-115817
Received Received - Intake

Denial of Service in Starman Perl Server

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: CPANSec

Description
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests. Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-115817
EUVD
EUVD-2026-109558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miyagawa starman to 0.4019 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Starman versions before 0.4019 for Perl have a vulnerability where a stalled request body can indefinitely hold a worker process. The existing read_timeout only covers headers, not the body. Attackers can send complete headers and then stall or trickle the body slowly, keeping workers occupied until disconnection. This exhausts all workers, causing a denial-of-service.

Detection Guidance

Monitor for stalled or slow request bodies by checking for connections that remain open for unusually long periods without completing data transmission. Use network tools like tcpdump or Wireshark to capture and analyze HTTP request patterns, focusing on Content-Length headers followed by incomplete or trickled data. Check server logs for repeated 408 Request Timeout responses, which indicate timeouts during body reads.

Impact Analysis

This vulnerability allows remote attackers to take down your Starman server by sending a few malicious connections. It can exhaust all available workers, preventing the server from responding to legitimate requests. The server stops answering requests until workers are freed.

Mitigation Strategies

Upgrade Starman to version 0.4019 or later to apply the body_timeout and read_timeout fixes. Configure --body-timeout and --read-timeout parameters to limit the time Starman waits for request bodies and between reads. Set --body-timeout to a reasonable value (default 300 seconds) and --read-timeout to a shorter duration (default 5 seconds) to prevent worker exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart