CVE-2026-115866
Description
A flaw was found in Starlet. When decoding chunked request bodies, an inefficient regular expression can result in catastrophic backtracking when encountering malformed chunk-size lines. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request, causing excessive CPU consumption and leading to a Denial of Service (DoS).
Statement
This vulnerability is rated as Important due to its ability to allow unauthenticated remote actors to monopolize server processing capacity and cause a denial of service with minimal network traffic. While the flaw carries high operational impact on internet-facing servers, Starlet is not distributed within Red Hat Enterprise Linux and is only packaged in Fedora community repositories. Consequently, default enterprise environments do not maintain an attack surface unless custom Perl application stacks integrate the standalone server directly.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
