CVE-2026-115866

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115866", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T17:41:34.521Z", "datePublished": "2026-10-30T12:45:39.814Z", "dateUpdated": "2026-11-06T16:44:02.533Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starlet"], "packageName": "Starlet", "packageURL": "pkg:cpan/Starlet", "programFiles": ["lib/Starlet/Server.pm"], "programRoutines": [{"name": "Starlet::Server::handle_connection"}], "repo": "https://github.com/kazuho/Starlet", "versions": [{"lessThan": "0.33", "status": "affected", "version": "0.20", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\n\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\n\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:45:39.814Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Starlet 0.33 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T16:43:18.883792Z", "id": "CVE-2026-115866", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:44:02.533Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:43:18.883792Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:43:53.031Z"}}], "cna": {"title": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/kazuho/Starlet", "modules": ["Starlet"], "versions": [{"status": "affected", "version": "0.20", "lessThan": "0.33", "versionType": "custom"}], "packageURL": "pkg:cpan/Starlet", "packageName": "Starlet", "programFiles": ["lib/Starlet/Server.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Starlet::Server::handle_connection"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Starlet 0.33 or later."}], "references": [{"url": "https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\n\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\n\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:45:39.814Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115866", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:44:02.533Z", "dateReserved": "2026-10-23T17:41:34.521Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-30T12:45:39.814Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starlet"], "packageName": "Starlet", "packageURL": "pkg:cpan/Starlet", "programFiles": ["lib/Starlet/Server.pm"], "programRoutines": [{"name": "Starlet::Server::handle_connection"}], "repo": "https://github.com/kazuho/Starlet", "versions": [{"lessThan": "0.33", "status": "affected", "version": "0.20", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\n\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\n\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called."}], "id": "CVE-2026-115866", "lastModified": "2026-11-06T17:17:13.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115866", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:43:18.883792Z", "version": "2.0.3"}}]}, "published": "2026-10-30T13:18:31.070", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-starlet: Starlet: Denial of Service via regular expression backtracking", "id": "2564043", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564043"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.", "A flaw was found in Starlet. When decoding chunked request bodies, an inefficient regular expression can result in catastrophic backtracking when encountering malformed chunk-size lines. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request, causing excessive CPU consumption and leading to a Denial of Service (DoS)."], "name": "CVE-2026-115866", "public_date": "2026-10-30T12:45:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115866\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115866\nhttps://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch\nhttps://metacpan.org/release/KAZUHO/Starlet-0.33/changes"], "statement": "This vulnerability is rated as Important due to its ability to allow unauthenticated remote actors to monopolize server processing capacity and cause a denial of service with minimal network traffic. While the flaw carries high operational impact on internet-facing servers, Starlet is not distributed within Red Hat Enterprise Linux and is only packaged in Fedora community repositories. Consequently, default enterprise environments do not maintain an attack surface unless custom Perl application stacks integrate the standalone server directly.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.20,0.33)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "starlet", "vendor": "kazuho"}], "created": "2026-10-30T14:30:08.696547+00:00", "updated": "2026-11-04T07:30:10.341903+00:00", "vendors": ["kazuho", "kazuho$PRODUCT$starlet"]}