Starman for Perl sends HEAD response bodies, desynchronizing responses
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Starman for Perl versions before 0.4019 write the application's response body for HEAD requests and for 1xx, 204 and 304 responses, where the body must not appear. On a keep-alive or pipelined connection, clients read those extra bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests, a flaw covered by CWE-444 that a remote attacker can trigger without credentials or user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Starman | before 0.4019 | 0.4019 | Patch available | CNA |
- Starman Vendor— Affected before 0.4019 Fixed in 0.4019 Patch available CNA
Remediation
Upgrade Starman for Perl to version 0.4019 or later, the version that fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA Starman Fixed in 0.4019
Vendor assessments
Timeline
- 2026-10-25 Threatist record created from CVE-2026-115823
- 2026-10-27 Alias added: GHSA-4q75-5w63-6hx7
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
- 2026-11-02 CVSS score added · CISA ADP
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-115823 · CVE Program
- CVE-2026-115823 · NVD
- FIRST EPSS
- GHSA-4q75-5w63-6hx7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115823 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences