Source: starman Version: 0.4018-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for starman. CVE-2026-115817[0]: | Starman versions before 0.4019 for Perl allow a stalled request body | to hold a worker indefinitely, as read_timeout covers only the | headers. Content-Length and chunked request bodies are read with | blocking reads and no deadline. A client that sends complete headers | and then stalls or trickles the body keeps the worker waiting until | it disconnects. A remote attacker can take every worker with a few | such connections, five with the default worker count, so the server | stops answering requests. Version 0.4019 applies read_timeout to | each wait for body data and adds a body_timeout limit, 300 seconds | by default, on the total time to read a body. CVE-2026-115822[1]: | Starman versions before 0.4019 for Perl allow CPU exhaustion via | quadratic regex backtracking when parsing chunked request bodies. | Starman decodes chunked request bodies before calling the | application, matching each chunk-size line with | `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by | a bare LF and then CRLF never matches, because `.` does not match | LF, and each failed attempt backtracks in time quadratic in the | length of the hex run. Nothing limits the length of the line. A | remote attacker can exhaust worker CPU by sending such requests to | any route. CVE-2026-115823[2]: | Starman versions before 0.4019 for Perl send response bodies for | HEAD requests, desynchronizing responses on keep-alive connections. | For a HEAD request Starman omits chunked framing but still writes | the body returned by the application, on both the array and | streaming response paths. Responses with a 1xx, 204 or 304 status | also carry the body. On a keep-alive or pipelined connection the | client reads those bytes as the start of the next response. A front- | end proxy that reuses upstream connections may then pair responses | with the wrong requests. CVE-2026-115824[3]: | Starman versions before 0.4019 for Perl allow memory exhaustion via | unbounded buffering of chunked request bodies. The chunked body | decoder keeps each chunk in memory until the whole chunk and its | CRLF have arrived, and sets no limit on the length of a chunk-size | line. A client that declares a huge chunk size and streams data, or | sends a chunk-size line that never ends, grows the buffer for as | long as it keeps sending. A remote attacker can exhaust worker | memory with a single connection. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115817 https://www.cve.org/CVERecord?id=CVE-2026-115817 [1] https://security-tracker.debian.org/tracker/CVE-2026-115822 https://www.cve.org/CVERecord?id=CVE-2026-115822 [2] https://security-tracker.debian.org/tracker/CVE-2026-115823 https://www.cve.org/CVERecord?id=CVE-2026-115823 [3] https://security-tracker.debian.org/tracker/CVE-2026-115824 https://www.cve.org/CVERecord?id=CVE-2026-115824 Regards, Salvatore
