Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115824— Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Quick assessment

Affected
CVE-2026-115824
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 环境下的 Starman 0.4019 之前版本存在内存耗尽漏洞，攻击者可利用分块请求体的无限制缓冲机制触发该问题。 分块体解码器会将每个分块保留在内存中，直到该分块及其末尾的 CRLF 完全接收为止，且未对分块大小行的长度设置任何限制。若客户端声明了巨大的分块大小并持续流式传输数据，或发送一条永不结束的分块大小行，缓冲区将随着客户端的持续发送而不断膨胀。 远程攻击者仅通过建立单个连接，即可耗尽工作进程（worker）的内存资源。

AI Predicted 7.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.4019 affected

I. Basic Information for CVE-2026-115824

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
Source: CVE Program / CVE List V5
Vulnerability Description
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending. A remote attacker can exhaust worker memory with a single connection.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.4019 -

II. Public POCs for CVE-2026-115824

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115824

请登录查看更多情报信息。

Other References for CVE-2026-115824 (3)

IV. Related Vulnerabilities

Same weakness: CWE-770