Memory Exhaustion in Starman Perl

Executive Summary

Starman versions before 0.4019 for Perl have a memory exhaustion vulnerability due to unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the entire chunk and its CRLF are received, with no limit on chunk size. Attackers can exploit this by sending a huge chunk size or an endless chunk-size line, causing the buffer to grow indefinitely and exhaust worker memory with a single connection.

Useful 0 Not Useful 0

Detection Guidance

Monitor memory usage of Starman worker processes during chunked transfer encoding requests. Check for processes consuming excessive memory (e.g., 900 MB RSS for 80 MiB of data) when handling chunked requests with large chunk sizes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to crash or severely degrade the performance of a Starman server by consuming all available memory on a worker process. This can lead to denial of service, system instability, or potential remote code execution if the system relies on memory constraints for security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Starman to version 0.4019 or later which implements a state machine for chunked decoding and writes data to temporary buffers instead of holding it all in memory.

Useful 0 Not Useful 0