CPANSA-Starlet-2026-116128: Starlet vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-10-30T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-10-30T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score Severity
Original language Language en
Also referred to

Vulnerability Description

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.

The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.

A remote attacker can exhaust a worker's memory with a single request.

Vulnerabilities

CVE-2026-116128

Vulnerability Description

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.

The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.

A remote attacker can exhaust a worker's memory with a single request.

Weakness CWE-770 : Allocation of Resources Without Limits or Throttling

Product status

Known affected
Product Score
Starlet greater than or equal 0.20 and less than 0.33
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Fri Oct 30 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/