For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.
On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Starman 0.4019 or later.
Vendor Workaround
For deployments that cannot upgrade to 0.4019, enable Plack::Middleware::Head, which removes the body from HEAD responses.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 25 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests. | |
| Title | Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections | |
| Weaknesses | CWE-444 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-25T16:51:19.961Z
Reserved: 2026-10-23T16:47:20.192Z
Link: CVE-2026-115823
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-25T17:17:01.743
Modified: 2026-10-25T17:17:01.743
Link: CVE-2026-115823
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-25T22:00:15Z
-
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')