CVE-2026-115823

Description

A flaw was found in Starman. The web server improperly sends message bodies for HTTP responses that should contain headers only, such as HEAD requests and certain status codes. A remote attacker can exploit this behavior over persistent connections to cause HTTP response desynchronization between intermediate proxies and backend servers. This desynchronization can result in information disclosure or request-response mispairing, potentially exposing sensitive data belonging to other users.

Statement

A flaw was found in Starman, a PSGI/Plack web server for Perl. Starman versions before 0.4019 improperly send response bodies for HTTP responses that should contain headers only, such as HEAD requests and responses with 1xx, 204, or 304 status codes. On keep-alive or pipelined connections this desynchronizes HTTP responses: a client, or a front-end proxy that reuses upstream connections, may read those extra bytes as the start of the next response and pair responses with the wrong requests, resulting in information disclosure or request-response mispairing. This issue is fixed in Starman 0.4019.

Mitigation

Upgrade to Starman 0.4019 or later. As a workaround, enable Plack::Middleware::Head, as suggested by the upstream CNA (CPANSec).

Understanding the Weakness (CWE)

CWE-444

Integrity,Non-Repudiation,Access Control

Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism

An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.