Starlet vulnerabilities

In Starlet versions from 0.20 before 0.33 for Perl, memory exhaustion is possible via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input; nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read; the data of a large chunk is also held in the buffer until the whole chunk has arrived.

In Starlet versions before 0.33 for Perl, responses to HEAD requests include a body, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent; with Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator; responses with status 204 or 304 are also sent with their body.

In Starlet versions from 0.20 before 0.33 for Perl, CPU exhaustion is possible via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF; a run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length; nothing limits the length of the run, which can span several reads.

In Starlet versions before 0.33 for Perl, a request declaring a large Content-Length can kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once; Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present, whereas per RFC 7230 3.3.3 Transfer-Encoding must take precedence.