CVE-2026-40560
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Starman for Perl before version 0.4018 is vulnerable to HTTP Request Smuggling due to improper header precedence. Starman incorrectly prioritizes Content-Length over Transfer-Encoding: chunked, violating RFC 7230. An attacker can exploit this to smuggle malicious HTTP requests through a front-end reverse proxy.
Risk Assessment
The risk involves bypassing reverse proxy security controls and executing unauthorized actions on the server, potentially leading to data integrity breaches or privilege escalation.
Recommendation
Immediately upgrade Starman to version 0.4018 or later, which correctly follows the Transfer-Encoding header precedence as per RFC.
Other vulnerabilities in Starman
See all- CVE-2026-115823Critical
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. Bodies are also sent for 1xx, 204, and 304 statuses. A client or proxy may read those bytes as the start of the next response.
- CVE-2026-115824High
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The decoder does not limit chunk-size line length or buffer size. A remote attacker can exhaust worker memory with a single connection.
- CVE-2026-115822High
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. A hex line followed by a bare LF and CRLF never matches, and each attempt backtracks quadratically. Line length is unbounded.
- CVE-2026-115817High
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only headers. Bodies are read with blocking reads and no deadline. An attacker can occupy all workers with a few connections.
Original NVD description (English source)
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS