Skip to content
Heist/ feed
Back to feed
Unrated

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Type: advisorySources: OSV

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-115823
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 00:26 UTC · Revision 1

Source evidence

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

core-osv · Original source

Published 25 Oct 2026, 16:51 UTC

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.

osv:CVE-2026-115823
Complete source record
{
  "id": "50cf54c89b86bef0a4cec0a71983391ab99fd6effa3531f613fb4d7a8650d141",
  "url": "https://osv.dev/vulnerability/CVE-2026-115823",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections",
    "summary": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.",
    "evidence": "osv:CVE-2026-115823",
    "products": [],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-115823",
      "aliases": [
        "CVE-2026-115823"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/miyagawa/starman",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3ec2aeda2fed955fc4a0604b9478aabdae537e88"
                },
                {
                  "fixed": "91c47c529cd1e100f938486896ea9083ec3ec7bf"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.4019"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "91c47c529cd1e100f938486896ea9083ec3ec7bf"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.4018",
            "0.4017",
            "0.4016",
            "0.4015",
            "0.4014",
            "0.4013",
            "0.4011",
            "0.4010",
            "0.4009",
            "0.4008",
            "0.4007",
            "0.4006",
            "0.4005",
            "0.4004",
            "0.4003",
            "0.4002",
            "0.4001",
            "0.4000",
            "0.3014",
            "0.3013",
            "0.3012",
            "0.3011",
            "0.3010",
            "0.3009",
            "0.3008",
            "0.3007",
            "0.3006",
            "0.3005",
            "0.3004",
            "0.3003",
            "0.3002",
            "0.3001",
            "0.3000",
            "0.29_90",
            "0.2014",
            "0.2013",
            "0.2012",
            "0.2011",
            "0.2010",
            "0.2009",
            "0.2008_2",
            "0.2008_1",
            "0.2008",
            "0.2007",
            "0.2006",
            "0.2005",
            "0.2004",
            "0.2003",
            "0.2002",
            "0.2001",
            "0.2000",
            "0.1007",
            "0.1006",
            "0.1005",
            "0.1004",
            "0.1003",
            "0.1002",
            "0.1001",
            "0.1000"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115823.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:45.410346361Z",
      "provider": "osv",
      "references": [
        "https://cpan.org/modules",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115823.json",
        "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-115823",
        "https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch",
        "https://github.com/miyagawa/Starman"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-444"
        ],
        "cna_assigner": "CPANSec",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115823.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-115823",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 513473,
  "published_at": "2026-10-25T16:51:19.961+00:00"
}