CVE-2026-115822
Received Received - Intake

CPU Exhaustion in Starman via Regex Backtracking

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: CPANSec

Description
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-115822
EUVD
EUVD-2026-109559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miyagawa starman to 0.4019 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Starman versions before 0.4019 for Perl are vulnerable to CPU exhaustion due to quadratic regex backtracking when parsing chunked request bodies. The issue occurs because the regex used to parse chunk sizes fails to match certain malformed inputs, causing excessive backtracking proportional to the input length. This allows remote attackers to consume CPU resources by sending specially crafted requests.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage on Starman servers, particularly when processing HTTP requests. Check for malformed chunked transfer encoding requests with long sequences of hexadecimal digits followed by LF and CRLF. Use tools like tcpdump or Wireshark to capture and analyze incoming HTTP requests for patterns matching the described attack vector.

Impact Analysis

This vulnerability can lead to denial-of-service conditions where an attacker sends malicious requests to exhaust CPU resources on the server. This may cause the server to slow down or become unresponsive, affecting the availability of services relying on Starman. Systems with limited resources are particularly vulnerable.

Mitigation Strategies

Immediately update Starman to version 0.4019 or later. If updating is not possible, implement network-level protections such as rate limiting or WAF rules to block malformed chunked transfer encoding requests. Temporarily disable chunked transfer encoding support if feasible until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart