CVE-2026-116128
Description
A flaw was found in Starlet. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) through memory exhaustion. The issue occurs because the server fails to restrict buffer sizes when decoding chunked HTTP request bodies, allowing unconsumed input to accumulate indefinitely without proper termination. By sending a specially crafted request, an attacker can exhaust worker memory, causing the application to crash or become unresponsive.
Statement
Red Hat classifies this flaw as Important because unauthenticated remote actors can exhaust host memory through unconstrained chunked transfers, resulting in a denial of service without requiring prior access or user interaction. Starlet commonly serves as a Plack or PSGI backend engine for Perl applications, making publicly reachable instances directly vulnerable to process termination. The operational risk is substantially reduced in environments where Starlet is shielded behind an edge reverse proxy that buffers incoming payloads or enforces strict request size restrictions.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
