Starman for Perl before 0.4019: four CVEs for denial of service and response desynchronization

What happened and what to do

The advisory was posted to the oss-sec list on 25 October by Robert Rothenberg and covers flaws in Starman, a web server for Perl applications, in versions before 0.4019. Three of the four CVEs cited are described in the text: CVE-2026-115817 lets a stalled request body keep a worker busy indefinitely, because read_timeout only covers headers; CVE-2026-115822 allows CPU exhaustion through quadratic regex backtracking when parsing fragmented request bodies; and CVE-2026-115823 causes responses to HEAD requests to include bodies, desynchronizing communication between client and server.

For a company running Perl applications behind Starman, the immediate path is to inventory which services use this version, upgrade to 0.4019 or later, and verify behavior in a staging environment. In parallel, it is worth monitoring busy worker counts, CPU usage and timeout error rates, with alerts that surface an exhaustion pattern before it takes the service down. It is also worth checking whether a reverse proxy in front of Starman enforces size and time limits on request bodies, reducing exposure while the upgrade reaches every environment.

How the consultancy can help

Exposure diagnosis: inventory of Perl services using Starman, production versions and exposed entry points. Then a staged upgrade plan with regression tests and monitoring of workers, CPU and timeout errors, implemented on the client's own infrastructure.

Next step

If your company runs Perl applications with Starman, send a short description of the environment (versions, where the service is hosted and whether there is a proxy in front) and receive a scoped proposal for diagnosis and remediation.