{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115865", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T17:37:33.627Z", "datePublished": "2026-10-30T12:44:06.034Z", "dateUpdated": "2026-11-06T16:42:32.074Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starlet"], "packageName": "Starlet", "packageURL": "pkg:cpan/Starlet", "programFiles": ["lib/Starlet/Server.pm"], "programRoutines": [{"name": "Starlet::Server::handle_connection"}], "repo": "https://github.com/kazuho/Starlet", "versions": [{"lessThan": "0.33", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:44:06.034Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Starlet 0.33 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T16:42:04.938586Z", "id": "CVE-2026-115865", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:42:32.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115865", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:42:04.938586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:42:25.385Z"}}], "cna": {"title": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/kazuho/Starlet", "modules": ["Starlet"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.33", "versionType": "custom"}], "packageURL": "pkg:cpan/Starlet", "packageName": "Starlet", "programFiles": ["lib/Starlet/Server.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Starlet::Server::handle_connection"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Starlet 0.33 or later."}], "references": [{"url": "https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:44:06.034Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115865", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:42:32.074Z", "dateReserved": "2026-10-23T17:37:33.627Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-30T12:44:06.034Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starlet"], "packageName": "Starlet", "packageURL": "pkg:cpan/Starlet", "programFiles": ["lib/Starlet/Server.pm"], "programRoutines": [{"name": "Starlet::Server::handle_connection"}], "repo": "https://github.com/kazuho/Starlet", "versions": [{"lessThan": "0.33", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."}], "id": "CVE-2026-115865", "lastModified": "2026-11-06T17:17:13.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115865", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:42:04.938586Z", "version": "2.0.3"}}]}, "published": "2026-10-30T13:18:30.947", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-starlet: perl-starlet: Denial of Service via large Content-Length header", "id": "2564024", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564024"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\nA remote attacker can force a worker restart with each request of a few bytes.", "A flaw was found in perl-starlet. When processing incoming HTTP requests, the server preallocates memory for the entire declared payload size before receiving the request body. A remote attacker can send an HTTP request with an excessively large Content-Length header, causing the application to exhaust available memory and terminate worker processes, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-115865", "public_date": "2026-10-30T12:44:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115865\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115865\nhttps://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch\nhttps://metacpan.org/release/KAZUHO/Starlet-0.33/changes"], "statement": "Red Hat rates the impact of this vulnerability as Important because an unauthenticated remote attacker can repeatedly terminate server workers and cause a persistent denial of service with minimal network overhead. This package is not included in standard Red Hat Enterprise Linux installations, restricting exposure primarily to Fedora environments or custom application stacks. Deployments that run the application server directly exposed to untrusted networks without a protective front-end proxy are most vulnerable to worker resource exhaustion.", "threat_severity": "Important"}