CVE-2026-115823

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115823", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T16:47:20.192Z", "datePublished": "2026-10-25T16:51:19.961Z", "dateUpdated": "2026-11-02T16:12:34.205Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starman"], "packageName": "Starman", "packageURL": "pkg:cpan/Starman", "programFiles": ["lib/Starman/Server.pm"], "programRoutines": [{"name": "Starman::Server::_finalize_response"}], "repo": "https://github.com/miyagawa/Starman", "versions": [{"lessThan": "0.4019", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:51:19.961Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Starman 0.4019 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 0.4019, enable Plack::Middleware::Head, which removes the body from HEAD responses."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T16:12:31.472777Z", "id": "CVE-2026-115823", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:12:34.205Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115823", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T16:12:31.472777Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:11:41.898Z"}}], "cna": {"title": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/miyagawa/Starman", "modules": ["Starman"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.4019", "versionType": "custom"}], "packageURL": "pkg:cpan/Starman", "packageName": "Starman", "programFiles": ["lib/Starman/Server.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Starman::Server::_finalize_response"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Starman 0.4019 or later."}], "references": [{"url": "https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 0.4019, enable Plack::Middleware::Head, which removes the body from HEAD responses."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:51:19.961Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115823", "state": "PUBLISHED", "dateUpdated": "2026-11-02T16:12:34.205Z", "dateReserved": "2026-10-23T16:47:20.192Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-25T16:51:19.961Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starman"], "packageName": "Starman", "packageURL": "pkg:cpan/Starman", "programFiles": ["lib/Starman/Server.pm"], "programRoutines": [{"name": "Starman::Server::_finalize_response"}], "repo": "https://github.com/miyagawa/Starman", "versions": [{"lessThan": "0.4019", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests."}], "id": "CVE-2026-115823", "lastModified": "2026-11-02T17:17:36.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115823", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T16:12:31.472777Z", "version": "2.0.3"}}]}, "published": "2026-10-25T17:17:01.743", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-starman: perl-starman: HTTP response desynchronization via improper response body handling", "id": "2560478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560478"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.", "A flaw was found in Starman. The web server improperly sends message bodies for HTTP responses that should contain headers only, such as HEAD requests and certain status codes. A remote attacker can exploit this behavior over persistent connections to cause HTTP response desynchronization between intermediate proxies and backend servers. This desynchronization can result in information disclosure or request-response mispairing, potentially exposing sensitive data belonging to other users."], "mitigation": {"lang": "en:us", "value": "Upgrade to Starman 0.4019 or later. As a workaround, enable Plack::Middleware::Head, as suggested by the upstream CNA (CPANSec)."}, "name": "CVE-2026-115823", "public_date": "2026-10-25T16:51:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115823\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115823\nhttps://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch\nhttps://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"], "statement": "A flaw was found in Starman, a PSGI/Plack web server for Perl. Starman versions before 0.4019 improperly send response bodies for HTTP responses that should contain headers only, such as HEAD requests and responses with 1xx, 204, or 304 status codes. On keep-alive or pipelined connections this desynchronizes HTTP responses: a client, or a front-end proxy that reuses upstream connections, may read those extra bytes as the start of the next response and pair responses with the wrong requests, resulting in information disclosure or request-response mispairing. This issue is fixed in Starman 0.4019.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.4019)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "starman", "vendor": "miyagawa"}], "created": "2026-10-25T22:00:15.237683+00:00", "updated": "2026-11-02T18:45:13.301123+00:00", "vendors": ["miyagawa", "miyagawa$PRODUCT$starman"]}