Starman (< 0.4019) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/starman--0.4019/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 00:32:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStarman: Multiple denial-of-service vulnerabilities (CVE-2026-115817, CVE-2026-115822, CVE-2026-115823)https://feed.craftedsignal.io/briefs/2026-10-starman-dos/Tue, 27 Oct 2026 00:32:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-starman-dos/Starman versions prior to 0.4019 are susceptible to multiple denial-of-service vectors, including resource exhaustion via stalled request bodies, CPU exhaustion from regex backtracking, and response desynchronization.Starman, a high-performance Perl web server, contains multiple vulnerabilities in versions prior to 0.4019. These flaws enable denial-of-service attacks against the web server infrastructure.

Impact

The vulnerabilities allow for service instability or total unavailability through resource exhaustion or protocol-level desynchronization. Specifically, attackers can lock up worker processes by stalling request bodies, cause CPU-bound denial of service via regex backtracking, or desynchronize communication by receiving unexpected response bodies for HEAD requests.

Recommendation

  • Upgrade the Starman Perl module to version 0.4019 or later across all environments where the web server is deployed.
  • Implement request timeout monitoring and rate limiting at the upstream load balancer or reverse proxy level to mitigate potential exploitation attempts while the patching process is underway.
]]>mediumadvisorydenial-of-servicewebserverperlvulnerability