{"id":"CVE-2026-115823","title":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections","summary":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application,…","severity":"none","cwe":["CWE-444"],"product":"Starman","affected":["Starman < 0.4019"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T16:51:19.961Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115823","references":[{"url":"https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch"},{"url":"https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.930Z","slug":"CVE-2026-115823","body":"## Overview\n\nStarman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.\n\n## Affected\n\n- `Starman < 0.4019`\n\n## Remediation\n\nUpgrade to Starman 0.4019 or later.\n\n### Workarounds\n\nFor deployments that cannot upgrade to 0.4019, enable Plack::Middleware::Head, which removes the body from HEAD responses.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}