Vulnerability Description
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.
Related Weaknesses (CWE)
References
- https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa24477078
- https://metacpan.org/release/KAZUHO/Starlet-0.33/changes
FAQ
What is CVE-2026-115865?
CVE-2026-115865 is a documented vulnerability. Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remai...
How severe is CVE-2026-115865?
CVSS scoring is not yet available for CVE-2026-115865. Check NVD for updates.
Is there a patch for CVE-2026-115865?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.