Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115822— Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Quick assessment

Affected
CVE-2026-115822
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 环境下 Starman 0.4019 之前的版本存在 CPU 耗尽漏洞：在解析分块（chunked）请求体时，由于正则表达式发生二次回溯（quadratic regex backtracking），攻击者可借此耗尽 CPU 资源。 Starman 在调用应用程序前会先解码分块请求体，使用正则表达式 匹配每个分块大小行。若某行由一串十六进制数字后接一个单独的行换符（LF）再跟回车换行符（CRLF）组成，则该行无法匹配成功，因为 不匹配 LF；每次匹配失败都会触发回溯，且回溯耗时与十六进制数字串长度的平方成正

AI Predicted 7.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.4019 affected

I. Basic Information for CVE-2026-115822

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Source: CVE Program / CVE List V5
Vulnerability Description
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.4019 -

II. Public POCs for CVE-2026-115822

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115822

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115822 (1)

Other References for CVE-2026-115822 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1333