[<prev] [next>] [day] [month] [year] [list]
Message-ID: <10082513d5e5a74bb60932ea9550e909@cpansec.org>
Date: Sat, 02 May 2026 21:58:17 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2026-40561: Starlet versions through 0.31 for Perl allows HTTP
Request Smuggling via Improper Header Precedence
========================================================================
CVE-2026-40561 CPAN Security Group
========================================================================
CVE ID: CVE-2026-40561
Distribution: Starlet
Versions: through 0.31
MetaCPAN: https://metacpan.org/dist/Starlet
VCS Repo: https://github.com/kazuho/Starlet
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling
via Improper Header Precedence
Description
-----------
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling
via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over
"Transfer-Encoding: chunked" when both headers are present in an HTTP
request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a
front-end reverse proxy.
Problem types
-------------
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP
Request/Response Smuggling')
Workarounds
-----------
Migrate to Starman 0.4018 or later which has fixed this issue or apply
the patch.
References
----------
https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
https://github.com/kazuho/Starlet/commit/a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0.patch
Timeline
--------
- 2026-04-12: Issue identified
- 2026-04-28: Maintainer notified
- 2026-05-02: Determined that the issue was already public on GitHub
Credits
-------
CPANSec, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
