---
id: CVE-2026-115823
title: >-
  Starman versions before 0.4019 for Perl send response bodies for HEAD
  requests, desynchronizing responses on keep-alive connections
summary: >-
  Starman versions before 0.4019 for Perl send response bodies for HEAD
  requests, desynchronizing responses on keep-alive connections.


  For a HEAD request Starman omits chunked framing but still writes the body
  returned by the application,…
severity: none
cwe:
  - CWE-444
product: Starman
affected:
  - Starman < 0.4019
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T16:51:19.961Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115823'
references:
  - url: >-
      https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch
  - url: 'https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes'
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.930Z'
---

## Overview

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.

For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.

On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.

## Affected

- `Starman < 0.4019`

## Remediation

Upgrade to Starman 0.4019 or later.

### Workarounds

For deployments that cannot upgrade to 0.4019, enable Plack::Middleware::Head, which removes the body from HEAD responses.