CVE-2026-115817
Description
A flaw was found in Starman. A remote attacker can cause a Denial of Service (DoS) by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked indefinitely waiting for data. By opening a small number of stalled connections, an attacker can exhaust all available worker processes and prevent the server from answering legitimate requests.
Statement
Starman before 0.4019 reads request bodies (both Content-Length and chunked) with blocking reads and no deadline; read_timeout applied only to headers. A remote, unauthenticated attacker can send complete headers and then stall or trickle the body, holding a worker until disconnect; with the default 5 workers, a few such connections exhaust all workers, causing denial of service. A buffering reverse proxy in front of Starman mitigates exposure. Fixed in 0.4019: read_timeout now applies to each body-data wait and the new body_timeout (default 300s) bounds total body read time; expiry returns 408.
Mitigation
Upgrade Starman to 0.4019 or later. As a workaround, place a buffering reverse proxy in front of Starman and limit concurrent connections; on fixed versions, tune --read-timeout/--body-timeout as needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
