CVE-2026-115866
Received Received - Intake

CPU Exhaustion via Regex Backtracking in Starlet

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads. A remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-115866
EUVD
EUVD-2026-113907

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kazuho starlet From 0.33|end_excluding=0.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Starlet versions from 0.20 before 0.33 for Perl are vulnerable to CPU exhaustion due to regular expression backtracking when processing chunked request bodies. A malicious request with a long hex digit run followed by a bare LF can cause the server to retry matching repeatedly, consuming significant CPU time per request.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU usage from processes handling HTTP requests, particularly those using Starlet versions before 0.33. Check server logs for requests with very long chunked transfer encoding headers or patterns matching hex digits followed by a bare LF.

Impact Analysis

This vulnerability allows a remote attacker to consume excessive CPU resources with a single request, potentially leading to degraded server performance, service outages, or denial of service. A 128 KiB request could occupy a worker for about a minute of CPU time before the application is called.

Mitigation Strategies

Immediately upgrade Starlet to version 0.33 or later. If upgrading is not possible, implement rate limiting on HTTP requests and monitor for suspicious patterns in chunked transfer encoding headers. Consider using a web application firewall to block malformed requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115866. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart