Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115817— Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

Quick assessment

Affected
CVE-2026-115817
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言编写的 Starman 0.4019 版本之前的版本存在漏洞：由于 仅覆盖请求头部分，若请求体（request body）传输停滞，会导致工作进程（worker）无限期等待。 具体而言， 和分块（chunked）编码的请求体均通过阻塞式读取处理，且未设置超时限制。若攻击者发送完整的请求头后，故意使请求体传输停滞或极慢地“滴灌”数据，工作进程将一直等待，直到客户端断开连接。 远程攻击者仅需建立少量此类连接（在默认工作进程数为 5 的情况下，5 个连接即可耗尽所有工作进程），即可导致服务器无法响应任何新的

AI Predicted 5.0 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.4019 affected

I. Basic Information for CVE-2026-115817

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers
Source: CVE Program / CVE List V5
Vulnerability Description
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests. Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.4019 -

II. Public POCs for CVE-2026-115817

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115817

请登录查看更多情报信息。

Other References for CVE-2026-115817 (3)

IV. Related Vulnerabilities

Same weakness: CWE-770