{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116128", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-25T10:18:33.774Z", "datePublished": "2026-10-30T12:46:30.844Z", "dateUpdated": "2026-10-30T12:46:30.844Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starlet"], "packageName": "Starlet", "packageURL": "pkg:cpan/Starlet", "programFiles": ["lib/Starlet/Server.pm"], "programRoutines": [{"name": "Starlet::Server::handle_connection"}], "repo": "https://github.com/kazuho/Starlet", "versions": [{"lessThan": "0.33", "status": "affected", "version": "0.20", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.\n\nThe decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.\n\nA remote attacker can exhaust a worker's memory with a single request."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T12:46:30.844Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/kazuho/Starlet/commit/f3472712fff64329a43d86368768d80b61714106.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Starlet 0.33 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Starlet"], "packageName": "Starlet", "packageURL": "pkg:cpan/Starlet", "programFiles": ["lib/Starlet/Server.pm"], "programRoutines": [{"name": "Starlet::Server::handle_connection"}], "repo": "https://github.com/kazuho/Starlet", "versions": [{"lessThan": "0.33", "status": "affected", "version": "0.20", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.\n\nThe decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.\n\nA remote attacker can exhaust a worker's memory with a single request."}], "id": "CVE-2026-116128", "lastModified": "2026-10-30T17:13:54.187", "metrics": {}, "published": "2026-10-30T13:18:31.293", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/kazuho/Starlet/commit/f3472712fff64329a43d86368768d80b61714106.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-starlet: Starlet: Denial of Service via unbounded buffering in chunked request decoding", "id": "2564059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564059"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.\nThe decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.\nA remote attacker can exhaust a worker's memory with a single request.", "A flaw was found in Starlet. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) through memory exhaustion. The issue occurs because the server fails to restrict buffer sizes when decoding chunked HTTP request bodies, allowing unconsumed input to accumulate indefinitely without proper termination. By sending a specially crafted request, an attacker can exhaust worker memory, causing the application to crash or become unresponsive."], "name": "CVE-2026-116128", "public_date": "2026-10-30T12:46:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116128\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116128\nhttps://github.com/kazuho/Starlet/commit/f3472712fff64329a43d86368768d80b61714106.patch\nhttps://metacpan.org/release/KAZUHO/Starlet-0.33/changes"], "statement": "Red Hat classifies this flaw as Important because unauthenticated remote actors can exhaust host memory through unconstrained chunked transfers, resulting in a denial of service without requiring prior access or user interaction. Starlet commonly serves as a Plack or PSGI backend engine for Perl applications, making publicly reachable instances directly vulnerable to process termination. The operational risk is substantially reduced in environments where Starlet is shielded behind an edge reverse proxy that buffers incoming payloads or enforces strict request size restrictions.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.20,0.33)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "starlet", "vendor": "kazuho"}], "created": "2026-10-30T14:45:14.460397+00:00", "updated": "2026-11-04T08:00:09.287626+00:00", "vendors": ["kazuho", "kazuho$PRODUCT$starlet"]}