CVE-2026-115817

Name	CVE-2026-115817
Description	Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests. Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1152054

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
starman (PTS)	bookworm	0.4016-1	vulnerable
	trixie	0.4018-0+deb13u1	vulnerable
	forky	0.4018-1	vulnerable
	sid	0.4019-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
starman	source	(unstable)	0.4019-1			1152054

Notes

https://lists.security.metacpan.org/cve-announce/msg/44625155/
Fixed by: https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558 (0.4019)
Fixed by: https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b (0.4019)