CVE-2026-115824
Description
A flaw was found in Starman. The chunked request body decoder does not properly limit chunk sizes or line lengths, leading to unbounded memory buffering. A remote attacker can exploit this vulnerability by sending streaming chunked requests, exhausting server memory and causing a Denial of Service (DoS).
Statement
Starman before 0.4019 buffers each chunked request-body chunk entirely in memory (with no bound on the chunk-size line length) before the terminating CRLF arrives. A remote, unauthenticated client can declare a huge chunk size and stream data, or send a never-ending chunk-size line, causing the worker process's memory to grow without bound (an 80 MiB request pushed a worker to ~900 MB RSS pre-fix), resulting in denial of service. Red Hat products do not ship Starman; the component appears only in Fedora community channels (perl-Starman 0.4018), which are below the fixed version 0.4019 that streams chunked bodies to Plack::TempBuffer.
Mitigation
Upgrade to Starman 0.4019 or later, which streams chunked request bodies to the temporary buffer (spilling to disk) instead of holding whole chunks in memory and bounds chunk-size line parsing. Until then, front Starman with a reverse proxy that limits request-body size and chunked-encoding line lengths, or reject/limit chunked transfer-encoded requests at the proxy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
