CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115823?
CVE-2026-115823 is a vulnerability, published on 25 Oct 2026.
Official description
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.
For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.
On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Weakness: CWE-444
Which versions are affected by CVE-2026-115823?
How do I fix CVE-2026-115823?
Upgrade to a fixed version.
Is CVE-2026-115823 being exploited?
There is no known exploitation of CVE-2026-115823 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115823, GHSA-4q75-5w63-6hx7, UBUNTU-CVE-2026-115823.