{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115817", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T16:22:27.039Z", "datePublished": "2026-10-25T16:50:33.914Z", "dateUpdated": "2026-10-25T16:50:33.914Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starman"], "packageName": "Starman", "packageURL": "pkg:cpan/Starman", "programFiles": ["lib/Starman/Server.pm"], "programRoutines": [{"name": "Starman::Server::_prepare_env"}], "repo": "https://github.com/miyagawa/Starman", "versions": [{"lessThan": "0.4019", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:50:33.914Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch"}, {"tags": ["patch"], "url": "https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Starman 0.4019 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starman"], "packageName": "Starman", "packageURL": "pkg:cpan/Starman", "programFiles": ["lib/Starman/Server.pm"], "programRoutines": [{"name": "Starman::Server::_prepare_env"}], "repo": "https://github.com/miyagawa/Starman", "versions": [{"lessThan": "0.4019", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body."}], "id": "CVE-2026-115817", "lastModified": "2026-10-26T17:13:55.323", "metrics": {}, "published": "2026-10-25T17:17:00.940", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-starman: Starman: Denial of Service via stalled HTTP request bodies", "id": "2560481", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560481"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.", "A flaw was found in Starman. A remote attacker can cause a Denial of Service (DoS) by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked indefinitely waiting for data. By opening a small number of stalled connections, an attacker can exhaust all available worker processes and prevent the server from answering legitimate requests."], "mitigation": {"lang": "en:us", "value": "Upgrade Starman to 0.4019 or later. As a workaround, place a buffering reverse proxy in front of Starman and limit concurrent connections; on fixed versions, tune --read-timeout/--body-timeout as needed."}, "name": "CVE-2026-115817", "public_date": "2026-10-25T16:50:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115817\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115817\nhttps://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch\nhttps://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch\nhttps://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"], "statement": "Starman before 0.4019 reads request bodies (both Content-Length and chunked) with blocking reads and no deadline; read_timeout applied only to headers. A remote, unauthenticated attacker can send complete headers and then stall or trickle the body, holding a worker until disconnect; with the default 5 workers, a few such connections exhaust all workers, causing denial of service. A buffering reverse proxy in front of Starman mitigates exposure. Fixed in 0.4019: read_timeout now applies to each body-data wait and the new body_timeout (default 300s) bounds total body read time; expiry returns 408.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.4019)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "starman", "vendor": "miyagawa"}], "created": "2026-10-25T21:45:06.575185+00:00", "updated": "2026-10-29T13:30:08.333443+00:00", "vendors": ["miyagawa", "miyagawa$PRODUCT$starman"]}