---
id: CVE-2026-115817
title: >-
  Starman versions before 0.4019 for Perl allow a stalled request body to hold a
  worker indefinitely, as read_timeout covers only the headers
summary: >-
  Starman versions before 0.4019 for Perl allow a stalled request body to hold a
  worker indefinitely, as read_timeout covers only the headers.


  Content-Length and chunked request bodies are read with blocking reads and no
  deadline. A clien…
severity: none
cwe:
  - CWE-770
product: Starman
affected:
  - Starman < 0.4019
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T16:50:33.914Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115817'
references:
  - url: >-
      https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch
  - url: >-
      https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch
  - url: 'https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes'
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.931Z'
---

## Overview

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.

Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.

A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.

Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.

## Affected

- `Starman < 0.4019`

## Remediation

Upgrade to Starman 0.4019 or later.