{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/starman--0.4019/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-115817"},{"id":"CVE-2026-115822"},{"id":"CVE-2026-115823"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Starman (\u003c 0.4019)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","webserver","perl","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eStarman, a high-performance Perl web server, contains multiple vulnerabilities in versions prior to 0.4019. These flaws enable denial-of-service attacks against the web server infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerabilities allow for service instability or total unavailability through resource exhaustion or protocol-level desynchronization. Specifically, attackers can lock up worker processes by stalling request bodies, cause CPU-bound denial of service via regex backtracking, or desynchronize communication by receiving unexpected response bodies for HEAD requests.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Starman Perl module to version 0.4019 or later across all environments where the web server is deployed.\u003c/li\u003e\n\u003cli\u003eImplement request timeout monitoring and rate limiting at the upstream load balancer or reverse proxy level to mitigate potential exploitation attempts while the patching process is underway.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T00:32:53Z","date_published":"2026-10-27T00:32:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-starman-dos/","summary":"Starman versions prior to 0.4019 are susceptible to multiple denial-of-service vectors, including resource exhaustion via stalled request bodies, CPU exhaustion from regex backtracking, and response desynchronization.","title":"Starman: Multiple denial-of-service vulnerabilities (CVE-2026-115817, CVE-2026-115822, CVE-2026-115823)","url":"https://feed.craftedsignal.io/briefs/2026-10-starman-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Starman (\u003c 0.4019)","version":"https://jsonfeed.org/version/1.1"}