CVE-2026-115865High· 7.5▾ TwilightStarlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl gr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
— → 7.5
none → high
0.2% → 0.4%
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.
The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.
A remote attacker can force a worker restart with each request of a few bytes.
Starlet < 0.33Upgrade to Starlet 0.33 or later.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116128High· 7.5Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies
CVE-2026-115866High· 7.5Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies
CVE-2026-116127Critical· 9.1Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection
CVE-2026-123563High· 7.5Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
CVE-2026-123616High· 7.5imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader
CVE-2026-121824High· 8.7A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.