Starlet: Multiple vulnerabilities leading to denial of service (CVE-2026-115865, CVE-2026-115866, CVE-2026-116127)
Starlet Perl server versions before 0.33 are vulnerable to memory and CPU exhaustion attacks, alongside response protocol corruption, caused by improper handling of HTTP requests.
CVE search metadata
CVE search record: CVE-2026-115865. KEV: no. Product: Starlet (< 0.33). Brief: Starlet: Multiple vulnerabilities leading to denial of service (CVE-2026-115865, CVE-2026-115866, CVE-2026-116127). Brief link: https://feed.craftedsignal.io/briefs/2026-10-starlet-perl-vulnerabilities/
CVE search record: CVE-2026-115866. KEV: no. Product: Starlet (< 0.33). Brief: Starlet: Multiple vulnerabilities leading to denial of service (CVE-2026-115865, CVE-2026-115866, CVE-2026-116127). Brief link: https://feed.craftedsignal.io/briefs/2026-10-starlet-perl-vulnerabilities/
CVE search record: CVE-2026-116127. KEV: no. Product: Starlet (< 0.33). Brief: Starlet: Multiple vulnerabilities leading to denial of service (CVE-2026-115865, CVE-2026-115866, CVE-2026-116127). Brief link: https://feed.craftedsignal.io/briefs/2026-10-starlet-perl-vulnerabilities/
Triage facts
Revision 1- Applicability
- Starlet (< 0.33)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 09:42 UTC
- Vulnerabilities
- 3 CVEs
- Source quality
- A1Likely
Starlet versions before 0.33 are affected by multiple vulnerabilities that can result in service disruption. CVE-2026-115865 allows for worker process memory exhaustion via specially crafted Content-Length headers. CVE-2026-115866 permits CPU exhaustion through regular expression backtracking during the decoding of chunked request bodies. Additionally, CVE-2026-116127 causes protocol corruption by incorrectly including bodies in responses to HEAD requests, which may affect subsequent request processing on persistent connections.
Impact
Successful exploitation of these vulnerabilities can lead to a denial of service (DoS) for the application hosting Starlet. Improper response handling for HEAD requests may lead to data corruption or desynchronization issues in proxy or load balancing environments.
Recommendation
- Upgrade Starlet to version 0.33 or later immediately.
- Audit existing infrastructure to identify instances of Starlet used in Perl-based web services.
- Implement request header size limits and body processing timeouts at the web server or load balancer layer as a temporary mitigation until services can be patched.
Immediate actions
Upgrade Starlet to version 0.33 or later
Threat Hunt
Identify high-frequency workers restarts or memory limit alerts for Perl-based web applications
Data: Process management logs or resource monitoring telemetry
Mitigations
Configure ingress proxy/load balancer to reject requests with excessively large Content-Length headers or unusual chunked encoding patterns
CVE-2026-115865, CVE-2026-115866