CVE-2026-116127
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the…
- Risk score
- 61/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is e…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.33 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body. Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.
Last activity 30 Oct 2026. Patch Forecast updates every hour.