CVE-2026-115824

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115824", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T16:47:20.192Z", "datePublished": "2026-10-25T16:51:39.510Z", "dateUpdated": "2026-11-02T16:17:28.862Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starman"], "packageName": "Starman", "packageURL": "pkg:cpan/Starman", "programFiles": ["lib/Starman/Server.pm"], "programRoutines": [{"name": "Starman::Server::_prepare_env"}], "repo": "https://github.com/miyagawa/Starman", "versions": [{"lessThan": "0.4019", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nThe chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.\n\nA remote attacker can exhaust worker memory with a single connection."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:51:39.510Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308.patch"}, {"tags": ["patch"], "url": "https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Starman 0.4019 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T16:17:00.972094Z", "id": "CVE-2026-115824", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:17:28.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115824", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T16:17:00.972094Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:16:58.044Z"}}], "cna": {"title": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/miyagawa/Starman", "modules": ["Starman"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.4019", "versionType": "custom"}], "packageURL": "pkg:cpan/Starman", "packageName": "Starman", "programFiles": ["lib/Starman/Server.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Starman::Server::_prepare_env"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Starman 0.4019 or later."}], "references": [{"url": "https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308.patch", "tags": ["patch"]}, {"url": "https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nThe chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.\n\nA remote attacker can exhaust worker memory with a single connection."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:51:39.510Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115824", "state": "PUBLISHED", "dateUpdated": "2026-11-02T16:17:28.862Z", "dateReserved": "2026-10-23T16:47:20.192Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-25T16:51:39.510Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starman"], "packageName": "Starman", "packageURL": "pkg:cpan/Starman", "programFiles": ["lib/Starman/Server.pm"], "programRoutines": [{"name": "Starman::Server::_prepare_env"}], "repo": "https://github.com/miyagawa/Starman", "versions": [{"lessThan": "0.4019", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nThe chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.\n\nA remote attacker can exhaust worker memory with a single connection."}], "id": "CVE-2026-115824", "lastModified": "2026-11-02T17:17:36.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115824", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T16:17:00.972094Z", "version": "2.0.3"}}]}, "published": "2026-10-25T17:17:01.853", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-starman: perl-starman: Denial of Service via unbounded buffering of chunked request bodies", "id": "2560482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560482"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\nThe chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.\nA remote attacker can exhaust worker memory with a single connection.", "A flaw was found in Starman. The chunked request body decoder does not properly limit chunk sizes or line lengths, leading to unbounded memory buffering. A remote attacker can exploit this vulnerability by sending streaming chunked requests, exhausting server memory and causing a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Upgrade to Starman 0.4019 or later, which streams chunked request bodies to the temporary buffer (spilling to disk) instead of holding whole chunks in memory and bounds chunk-size line parsing. Until then, front Starman with a reverse proxy that limits request-body size and chunked-encoding line lengths, or reject/limit chunked transfer-encoded requests at the proxy."}, "name": "CVE-2026-115824", "public_date": "2026-10-25T16:51:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115824\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115824\nhttps://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch\nhttps://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308.patch\nhttps://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"], "statement": "Starman before 0.4019 buffers each chunked request-body chunk entirely in memory (with no bound on the chunk-size line length) before the terminating CRLF arrives. A remote, unauthenticated client can declare a huge chunk size and stream data, or send a never-ending chunk-size line, causing the worker process's memory to grow without bound (an 80 MiB request pushed a worker to ~900 MB RSS pre-fix), resulting in denial of service. Red Hat products do not ship Starman; the component appears only in Fedora community channels (perl-Starman 0.4018), which are below the fixed version 0.4019 that streams chunked bodies to Plack::TempBuffer.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.4019)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "starman", "vendor": "miyagawa"}], "created": "2026-10-25T21:45:06.575010+00:00", "updated": "2026-10-29T13:30:08.331941+00:00", "vendors": ["miyagawa", "miyagawa$PRODUCT$starman"]}