Cve-2026-115865 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-115865/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 09:42:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStarlet: Multiple vulnerabilities leading to denial of service (CVE-2026-115865, CVE-2026-115866, CVE-2026-116127)https://feed.craftedsignal.io/briefs/2026-10-starlet-perl-vulnerabilities/Sat, 31 Oct 2026 09:42:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-starlet-perl-vulnerabilities/Starlet Perl server versions before 0.33 are vulnerable to memory and CPU exhaustion attacks, alongside response protocol corruption, caused by improper handling of HTTP requests.Starlet versions before 0.33 are affected by multiple vulnerabilities that can result in service disruption. CVE-2026-115865 allows for worker process memory exhaustion via specially crafted Content-Length headers. CVE-2026-115866 permits CPU exhaustion through regular expression backtracking during the decoding of chunked request bodies. Additionally, CVE-2026-116127 causes protocol corruption by incorrectly including bodies in responses to HEAD requests, which may affect subsequent request processing on persistent connections.

Impact

Successful exploitation of these vulnerabilities can lead to a denial of service (DoS) for the application hosting Starlet. Improper response handling for HEAD requests may lead to data corruption or desynchronization issues in proxy or load balancing environments.

Recommendation

  • Upgrade Starlet to version 0.33 or later immediately.
  • Audit existing infrastructure to identify instances of Starlet used in Perl-based web services.
  • Implement request header size limits and body processing timeouts at the web server or load balancer layer as a temporary mitigation until services can be patched.
]]>mediumadvisorydenial-of-serviceweb-serverperlcve-2026-115865cve-2026-115866cve-2026-116127