CVE-2026-115823
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing…
- Risk score
- 61/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 25 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 s…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.4019 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Last activity 25 Oct 2026. Patch Forecast updates every hour.