EUVD-2026-113906: Starlet Perl server can be crashed via large Content-Length
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Starlet
- Product
- Starlet for Perl
- First seen
Summary
The EU vulnerability database (EUVD) lists EUVD-2026-113906 for Starlet versions before 0.33 for Perl. The entry says a request declaring a large Content-Length can kill a worker by exhausting memory; no score is listed.
If you use Starlet
Upgrade Starlet to version 0.33 or later
Monitor worker restarts and memory use
Monitor CPU use on Perl application servers
Check applications for HEAD handling that relies on the affected behavior
Monitor memory use on Perl application servers
What the sources say 4
· Mastodon: “Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.” Source
· Mastodon: “Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection.” Source
· Mastodon: “Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.” Source
· Mastodon: “Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.” Source