CVE-2026-115822: Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-25 · updated 2026-10-26
Weakness: CWE-1333

Description

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.

Affected products

Starman: before 0.4019 — fixed in 0.4019

How to fix

Upgrade to a fixed version: Starman 0.4019. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-115822 or the next vulnerability affects your stack