{"id":"CVE-2026-115817","revision":"799e7d1364964861b0d8f7f7c817c077","records":[{"revision":"799e7d1364964861b0d8f7f7c817c077","observedAt":"2026-10-25T18:09:37.585+00:00","statement":{"source":"cve-program","id":"CVE-2026-115817","aliases":[],"title":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers","description":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.","state":0,"publishedAt":"2026-10-25T16:50:33.914+00:00","modifiedAt":"2026-10-25T16:50:33.914+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"Starman","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Starman\"\n                    ],\n                    \"packageName\": \"Starman\",\n                    \"packageURL\": \"pkg:cpan/Starman\",\n                    \"programFiles\": [\n                        \"lib/Starman/Server.pm\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Starman::Server::_prepare_env\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/miyagawa/Starman\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.4019\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch","https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch","https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115817","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115817","identifiers":["CVE-2026-115817"]},"retained":false,"historicalAffected":[]}],"coverage":[]}