Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115823— Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Quick assessment

Affected
CVE-2026-115823
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 环境下 Starman 0.4019 之前的版本在处理 HEAD 请求时会发送响应实体（response body），从而导致在持久连接（keep-alive）上出现响应错位。 具体而言，对于 HEAD 请求，Starman 虽然会省略分块传输编码（chunked framing），但无论是在数组响应路径还是流式响应路径上，仍会将应用程序返回的响应实体写入输出。此外，状态码为 1xx、204 或 304 的响应也会携带响应实体。 在持久连接或请求流水线（pipelined）连接中，客户端会将这些额外的字节

AI Predicted 7.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.4019 affected

I. Basic Information for CVE-2026-115823

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections
Source: CVE Program / CVE List V5
Vulnerability Description
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.4019 -

II. Public POCs for CVE-2026-115823

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115823

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115823 (1)

Other References for CVE-2026-115823 (1)

IV. Related Vulnerabilities

Same weakness: CWE-444