CVE-2026-115822: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-115822 is a Denial of Service vulnerability in Starman, a high-performance preforking PSGI/Plack web server for Perl, caused by catastrophic regex backtracking during chunked HTTP request body parsing. All Starman versions before 0.4019 are affected. The vulnerability was disclosed on October 25, 2026, with a patch released in version 0.4019. It is classified as Medium severity with an EPSS score of 0.0 (GitHub Advisory, ENISA EUVD).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity), specifically catastrophic backtracking in the chunk-size line parsing regex s/^(([0-9a-fA-F]+).*\015\012)//. When Starman decodes chunked transfer-encoded request bodies, it attempts to match each chunk-size line against this pattern. A malformed line consisting of a long run of hex digits followed by a bare LF (\n) and then CRLF (\r\n) never matches because the . metacharacter does not match LF; each failed match attempt causes the regex engine to backtrack in O(n²) time relative to the length of the hex digit sequence, with no upper bound on line length enforced. The fix in version 0.4019 replaces the regex-based approach with index() to locate CRLF, enforces a 4 KiB maximum chunk-size line length, and uses a new anchored linear-time _parse_chunk_size() function; malformed requests now receive a 400 response and are never dispatched to the application (GitHub Patch, GitHub Advisory).

Successful exploitation causes CPU exhaustion in Starman worker processes, rendering them unresponsive and resulting in a Denial of Service for all routes served by the affected instance. The attack requires no authentication and can be directed at any HTTP endpoint, meaning the entire application is affected regardless of its logic or access controls. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, ENISA EUVD).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability is remotely exploitable by unauthenticated attackers over the network, requiring only the ability to send HTTP requests with chunked transfer encoding. The EPSS score is 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (ENISA EUVD, GitHub Advisory).

1. Reconnaissance: Identify internet-facing services running Starman (versions before 0.4019) by fingerprinting HTTP server headers or scanning for Perl/PSGI application stacks.
2. Craft malicious request: Construct an HTTP POST request with Transfer-Encoding: chunked targeting any route on the server.
3. Inject malformed chunk-size line: In the request body, include a chunk-size line consisting of a long sequence of hex digits (e.g., "f" x 32768) followed by a bare LF (\n) and then CRLF (\r\n), e.g.:

   POST /any-route HTTP/1.1\r\n
   Host: target\r\n
   Transfer-Encoding: chunked\r\n
   \r\n
   ffffffff...fff\n\r\n

4. Trigger backtracking: The Starman worker attempts to match the malformed chunk-size line against the vulnerable regex, causing quadratic-time backtracking. A 32 KiB hex run costs approximately 1.7 seconds of worker CPU per request.
5. Exhaust workers: Send multiple such requests concurrently to saturate all available Starman worker processes, causing a complete Denial of Service (GitHub Patch).

• Network: Inbound HTTP POST requests with Transfer-Encoding: chunked headers containing unusually long chunk-size lines (thousands of hex characters) before a CRLF terminator; high volume of such requests from one or more source IPs targeting any route.
• Process: Starman worker processes exhibiting sustained near-100% CPU utilization without corresponding application logic load; workers becoming unresponsive or timing out.
• Logs: Access logs showing POST requests to arbitrary routes with chunked encoding that do not complete normally; absence of application-level response logs for requests that consumed significant CPU time (in unpatched versions, the app is never dispatched, so no app-level log entry appears).

Upgrade Starman to version 0.4019 or later, which replaces the vulnerable regex with a linear-time parser and enforces a 4 KiB maximum chunk-size line length, returning HTTP 400 for malformed requests without dispatching them to the application. As a temporary workaround prior to patching, implement rate limiting on incoming HTTP requests at the network or load balancer level, and consider deploying a WAF or reverse proxy (e.g., nginx) configured to reject or limit chunked transfer encoding requests with abnormally long chunk-size lines (GitHub Patch, MetaCPAN Changelog).