---
id: CVE-2026-115865
title: >-
  Starlet versions before 0.33 for Perl allow a request declaring a large
  Content-Length to kill a worker by exhausting memory
summary: >-
  Starlet versions before 0.33 for Perl allow a request declaring a large
  Content-Length to kill a worker by exhausting memory.


  The request body is read in a loop that asks sysread for all of the remaining
  declared length at once. Perl gr…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-789
product: Starlet
affected:
  - Starlet < 0.33
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T16:42:04.938586Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:42:32.074Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115865'
references:
  - url: >-
      https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch
  - url: 'https://metacpan.org/release/KAZUHO/Starlet-0.33/changes'
tags:
  - cve.org
epss: 0.00384
epssPercentile: 0.3272
ingestedAt: '2026-11-05T16:07:30.202Z'
---

## Overview

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.

The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.

A remote attacker can force a worker restart with each request of a few bytes.

## Affected

- `Starlet < 0.33`

## Remediation

Upgrade to Starlet 0.33 or later.