CVE-2026-115817 Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115817?
CVE-2026-115817 is a vulnerability, published on 25 Oct 2026.
Official description
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.
Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.
A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.
Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
Weakness: CWE-770
Which versions are affected by CVE-2026-115817?
How do I fix CVE-2026-115817?
Upgrade to a fixed version.
Is CVE-2026-115817 being exploited?
There is no known exploitation of CVE-2026-115817 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115817, GHSA-xcqf-6xfj-3q3x, UBUNTU-CVE-2026-115817.