CVE-2026-115865
Received Received - Intake

Memory Exhaustion in Starlet Perl Module

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-115865
EUVD
EUVD-2026-113906

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kazuho starlet to 0.33 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Starlet versions before 0.33 for Perl have a memory exhaustion vulnerability. When a request declares a very large Content-Length header, the server tries to allocate memory for the entire body size immediately. This causes the worker process to crash with an out-of-memory error before processing the request.

Detection Guidance

Monitor for repeated worker crashes or out-of-memory errors in Starlet servers. Check logs for requests with unusually large Content-Length headers. Use tools like tcpdump or Wireshark to inspect HTTP headers for abnormally large values.

Impact Analysis

A remote attacker can send requests with large Content-Length headers to force worker restarts. This leads to denial-of-service as each request causes a worker to crash and restart, disrupting service availability.

Mitigation Strategies

Upgrade Starlet to version 0.33 or later. Implement rate limiting to prevent excessive requests. Use a reverse proxy like Nginx to filter malformed headers before they reach Starlet.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115865. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart