CVE-2026-115817

{"id": "CVE-2026-115817", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/miyagawa/Starman", "modules": ["Starman"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.4019", "versionType": "custom"}], "packageURL": "pkg:cpan/Starman", "packageName": "Starman", "programFiles": ["lib/Starman/Server.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Starman::Server::_prepare_env"}]}]}], "published": "2026-10-25T17:17:00.940", "references": [{"url": "https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body."}], "lastModified": "2026-10-26T17:13:55.323", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}