Starman: Multiple denial-of-service vulnerabilities (CVE-2026-115817, CVE-2026-115822, CVE-2026-115823)

Starman, a high-performance Perl web server, contains multiple vulnerabilities in versions prior to 0.4019. These flaws enable denial-of-service attacks against the web server infrastructure.

Impact

The vulnerabilities allow for service instability or total unavailability through resource exhaustion or protocol-level desynchronization. Specifically, attackers can lock up worker processes by stalling request bodies, cause CPU-bound denial of service via regex backtracking, or desynchronize communication by receiving unexpected response bodies for HEAD requests.

Recommendation

• Upgrade the Starman Perl module to version 0.4019 or later across all environments where the web server is deployed.
• Implement request timeout monitoring and rate limiting at the upstream load balancer or reverse proxy level to mitigate potential exploitation attempts while the patching process is underway.