Excessive memory allocation in Starlet for Perl kills worker processes
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-789.
Summary
Starlet for Perl, versions before 0.33, lets a remote attacker force a worker restart without authentication by sending a request that declares a large Content-Length. The request body is read with a single sysread call for the whole declared length, so Perl allocates that memory before any data arrives. A length larger than available memory makes the worker exit with an uncatchable out of memory error before the application runs, and a request of a few bytes can repeat the attack (CWE-789).
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Starlet | before 0.33 | 0.33 | Patch available | CNA |
- Starlet Vendor— Affected before 0.33 Fixed in 0.33 Patch available CNA
Remediation
Upgrade Starlet to version 0.33 or later, which fixes the flaw. The sources list no other fixed version for Starlet.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Starlet Fixed in 0.33
Vendor assessments
Timeline
- 2026-10-30 Threatist record created from CVE-2026-115865
- 2026-10-30 Alias added: GHSA-xfc8-r6h3-qmmm
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-11-06 CVSS score added · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
References
Sources
- CVE-2026-115865 · CVE Program
- CVE-2026-115865 · NVD
- FIRST EPSS
- GHSA-xfc8-r6h3-qmmm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115865 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences