The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Kazuho | Starlet | 80% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
Upgrade to Starlet 0.33 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 30 Oct 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Kazuho
Kazuho starlet |
|
| Vendors & Products |
Kazuho
Kazuho starlet |
Fri, 30 Oct 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes. | |
| Title | Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory | |
| Weaknesses | CWE-789 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T12:44:06.034Z
Reserved: 2026-10-23T17:37:33.627Z
Link: CVE-2026-115865
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-30T13:18:30.947
Modified: 2026-10-30T17:13:54.187
Link: CVE-2026-115865
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T16:00:15Z
-
CWE-789
Memory Allocation with Excessive Size Value