CVE-2026-115822
Description
A flaw was found in Starman. A remote attacker can trigger a Denial of Service (DoS) by sending specially crafted HTTP requests containing malformed chunked request bodies. Due to inefficient regular expression evaluation when parsing chunk sizes without proper length limits, worker processes consume excessive CPU resources, resulting in service unresponsiveness.
Statement
This vulnerability is rated Important because an unauthenticated remote attacker can cause a denial of service by exhausting worker CPU capacity with malformed chunked transfer requests. Because Starman parses incoming HTTP request bodies before dispatching them to PSGI applications, any accessible endpoint is susceptible to resource starvation without requiring valid credentials or elevated privileges. The overall risk is constrained to service availability, as the issue does not permit arbitrary code execution or unauthorized access to sensitive application data.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
