{"id":"CVE-2026-115823","revision":"88b73799248c4b95b59320fd121be0ca","records":[{"revision":"88b73799248c4b95b59320fd121be0ca","observedAt":"2026-10-25T18:09:37.585+00:00","statement":{"source":"cve-program","id":"CVE-2026-115823","aliases":[],"title":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections","description":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.","state":0,"publishedAt":"2026-10-25T16:51:19.961+00:00","modifiedAt":"2026-10-25T16:51:19.961+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"Starman","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Starman\"\n                    ],\n                    \"packageName\": \"Starman\",\n                    \"packageURL\": \"pkg:cpan/Starman\",\n                    \"programFiles\": [\n                        \"lib/Starman/Server.pm\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Starman::Server::_finalize_response\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/miyagawa/Starman\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.4019\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch","https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115823","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115823","identifiers":["CVE-2026-115823"]},"retained":false,"historicalAffected":[]}],"coverage":[]}