CVE-2026-115824: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-115824 is a memory exhaustion vulnerability in Starman, a high-performance preforking PSGI/Plack web server for Perl. The flaw allows an unauthenticated remote attacker to exhaust worker memory via unbounded buffering of chunked HTTP request bodies, causing a denial of service. All Starman versions before 0.4019 are affected. The vulnerability was disclosed on October 25, 2026, with a patch released in version 0.4019. The CVSS category estimate is HIGH, and the EPSS score is 0.0 at time of publication (GitHub Advisory, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in Starman's chunked HTTP request body decoder within lib/Starman/Server.pm. The dechunker accumulated each chunk entirely in memory before writing it to the output buffer, and imposed no limit on the length of the chunk-size line. An attacker can exploit this in two ways: (1) declare a very large chunk size (e.g., fffffffff) and stream data continuously, causing the in-memory buffer to grow without bound — sending 80 MiB of data was observed to push one worker to approximately 900 MB RSS; or (2) send a chunk-size line that never terminates with CRLF, causing indefinite buffering. The fix, introduced in two commits, replaces the monolithic buffer with a streaming state machine that writes chunk data to Plack::TempBuffer (which spills to disk) as it arrives, and enforces a 4 KiB maximum chunk-size line length (Starman Commit d789a02, Starman Commit 0f33f9b).

Successful exploitation causes denial of service by exhausting the memory of Starman worker processes. A single unauthenticated TCP connection is sufficient to trigger the condition, making the attack highly efficient and requiring no credentials or special privileges. Affected applications running on Starman become unresponsive as workers run out of memory, potentially taking down the entire web service. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting a currently low probability of exploitation. However, the attack is trivially executable by any remote, unauthenticated attacker with network access to a Starman instance, requiring only a crafted HTTP request with a chunked transfer encoding (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible services running Starman (a Perl PSGI/Plack server), which may be identifiable via HTTP response headers (e.g., Server: Starman/0.xxxx) or service fingerprinting tools like Shodan or Censys.
2. Craft malicious HTTP request: Construct an HTTP/1.1 POST request with the Transfer-Encoding: chunked header targeting any endpoint on the Starman server.
3. Declare oversized chunk: In the chunked body, send a chunk-size line declaring a very large chunk size (e.g., fffffffff\r\n) without sending the corresponding data volume, or send a chunk-size line that never terminates with CRLF.
4. Stream data slowly: Begin streaming arbitrary data bytes at a slow rate. The vulnerable Starman worker accumulates all received bytes in memory while waiting for the full chunk and its trailing CRLF to arrive.
5. Exhaust worker memory: Continue streaming data until the targeted worker process exhausts available memory (e.g., 80 MiB sent can push a worker to ~900 MB RSS), causing it to crash or become unresponsive, effectively denying service to legitimate users (Starman Commit d789a02).

• Network: Persistent, long-lived HTTP/1.1 connections from a single client IP sending POST requests with Transfer-Encoding: chunked; unusually slow or never-completing chunked request bodies; connections that stream data at a low rate for extended periods.
• Logs: Starman access logs showing POST requests that never complete or take an abnormally long time; repeated connections from the same source IP with chunked transfer encoding.
• Process: Starman worker processes (starman worker) exhibiting rapidly growing RSS memory consumption (potentially hundreds of MB per worker); worker processes being killed by the OS OOM killer (oom-kill entries in system logs).
• System: Kernel OOM killer events in /var/log/syslog or dmesg referencing Starman worker PIDs; sudden drops in available system memory correlated with incoming HTTP connections.

Upgrade Starman to version 0.4019 or later, which introduces a streaming state machine dechunker that writes chunk data to disk-backed Plack::TempBuffer as it arrives and enforces a 4 KiB maximum chunk-size line length. As a network-level workaround prior to patching, deploy a reverse proxy (e.g., nginx) or WAF in front of Starman that enforces limits on chunked request body sizes and connection timeouts. Additionally, implement rate limiting per client IP to restrict the number of concurrent long-lived connections reaching the Starman backend (Starman Commit d789a02, MetaCPAN Changelog).

The vulnerability was assigned by CPANSec, the Perl CPAN security team, and the fix was authored by Tatsuhiko Miyagawa (the original Starman author) with AI assistance (Claude Opus 5.5). A brief mention appeared on Bluesky via the CVE feed account shortly after disclosure. No significant broader media coverage or notable researcher commentary has been identified beyond the standard vulnerability database entries (GitHub Advisory).