[From nobody Sun Oct 25 23:53:08 2026 Received: (at 1152054-close) by bugs.debian.org; 25 Oct 2026 23:50:50 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 101; hammy, 150; neutral, 211; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:38628) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xL7zH-005g1e-0W for 1152054-close@bugs.debian.org; Sun, 25 Oct 2026 23:50:50 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xL7zF-000MIS-0T for 1152054-close@bugs.debian.org; Sun, 25 Oct 2026 23:50:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=VkjE9q0GvTFTJuKB0ylzFtmaAokW+RfFaK6DvGmumcg=; b=OF7gupk5eojtUbXKAILRh3+Bi/ 60tPXyQPjuroVuKZ0ZDL4CTfZecFBKUMnI33wQacy6LJ8oVY36v9MbioXWvNSWGiGplKl/hySiAST ZIpxlkFHTrla2DtuailHgTDYvbRqqPG61F8EwfmflVpEBsbXY1t2TWPMicxpXseD94j/m+FCfvkAi N454IyomDrqgpeq6mdQmkmHN+Shh3GZprtGxSXrmHp5e826Sogj4CnMtwfB2707GBPF5w2LnUaHYt NAspi8qYRM0mF3bwBan0qJIVynr7vhBSbajKNOrGuaK9e+n09EbiAOEx5KY6rtmr5ek9Ci4e2T6H3 22BK3XzA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xL7zE-0000000CbxE-1Ffq; Sun, 25 Oct 2026 23:50:48 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: gregor herrmann <gregoa@debian.org> To: 1152054-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: starman Debian: DAK Debian-Changes: starman_0.4019-1_source.changes Debian-Source: starman Debian-Version: 0.4019-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1152054: fixed in starman 0.4019-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============2247377934427124890==" Message-Id: <E1xL7zE-0000000CbxE-1Ffq@fasolo.debian.org> Date: Sun, 25 Oct 2026 23:50:48 +0000 --===============2247377934427124890== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: starman Source-Version: 0.4019-1 Done: gregor herrmann <gregoa@debian.org> We believe that the bug you reported is fixed in the latest version of starman, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1152054@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. gregor herrmann <gregoa@debian.org> (supplier of updated starman package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 26 Oct 2026 00:21:19 +0100 Source: starman Architecture: source Version: 0.4019-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1152054 Changes: starman (0.4019-1) unstable; urgency=3Dmedium . * Team upload. * Import upstream version 0.4019. - Stream chunked request bodies to the temporary buffer instead of holdi= ng whole chunks in memory (CVE-2026-115824) - Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) - Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) - Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Closes: #1152054 * Mention behaviour changes in debian/NEWS.Developer. * Update test dependencies. * Convert debian/watch to version 5. Checksums-Sha1: eb625ffa40192b369c2f49c3a9ccce39eb9859b0 2580 starman_0.4019-1.dsc 8f8e18d4e275df8641256a3516069dcb7060d2d7 45120 starman_0.4019.orig.tar.gz 1623e3eaade4859cd347b976c27fb6ef5105a7a7 4808 starman_0.4019-1.debian.tar.xz 9d20d9380ee2174f00978bccb8a0981812f3cebb 105876 starman_0.4019-1.git.tar.xz 075ca65d25cedaf8ca743d3160ed10aaf7f963e0 17736 starman_0.4019-1_source.build= info Checksums-Sha256: 68b4e7a3acace09ba89ed5de95338a3e7f8d1eae04cf8484b6a1edb07803041f 2580 starma= n_0.4019-1.dsc 4a33f20a6a3250938fc85e21779e34c56e156895fe4a8fa8c83ac4e96ecaef61 45120 starm= an_0.4019.orig.tar.gz 4503e0b720a6ba6e73134a92b7dd5b8e795bfbdc627cc956f95ea724193501e5 4808 starma= n_0.4019-1.debian.tar.xz a5da90b7dbdc0935a99cef1c467f0794293237a118f1e6d976c6abf601f2742e 105876 star= man_0.4019-1.git.tar.xz 7f4c1308d5c4c5ef89a601ffe3c7c0d34d8271f426cfa2630d9c37dde2a81f5e 17736 starm= an_0.4019-1_source.buildinfo Files: 68afdfa5ce6cad728f37790a748f3c2c 2580 perl optional starman_0.4019-1.dsc b172f13b7c20b46e1499b07a91b69e4e 45120 perl optional starman_0.4019.orig.tar= .gz 1e36d2b2ff9d5b20b35bcf18e662b2ba 4808 perl optional starman_0.4019-1.debian.= tar.xz 211930932dfeab1beb41a71943027d37 105876 perl None starman_0.4019-1.git.tar.xz a52615d1040124e4a7453a37967212d7 17736 perl optional starman_0.4019-1_source= .buildinfo Git-Tag-Info: tag=3D4a247424f4d0e3ca2abb34f4560f29dc483b78b9 fp=3Dd1e1316e93a= 760a8104d85fabb3a68018649aa06 Git-Tag-Tagger: gregor herrmann <gregoa@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrekA4ACgkQYG0ITkaD wHmNChAA7dFs8pa0yUnWFQpYfJnEJMJ9BbIoCrZNEXA1tpyuaerRpBaIHr6KzcVj BzzWoI0NhOX5jzFkeq9YAubR+GwBdakQzsdYHQ7m1ZASaJYMtVnrE5naAAxhO4nC HUH0fVhM+ppJIiuXm17AvHddHYYm9Q5onQgB6IOf2qGlYcWqEaCH2R742x3fhZ5+ hdgEPP8r6p+eveLgU1mV0kir0VFaxGInuQ5lIXJVCUecYH0KPOqCotuNo4TGD+hI 7mJUUX/6nN4+Js0ru/NHiaFN1BQy5RxGEoUMWsUlOJCzapsNxVNqaWo22bM75iAG Fp8kHYwRK5cmOFIYJTr+vbx6SjSNnlhEzj8OHedDFNExF5v2FEJnZXfEEg8TFP6l PGFHe8Cbc9OdCcbh70RYqa/aqhBRTEr4M2Sqp+E/otdz9EIh5cIkBPrev7YZbQGd EXq6pCb9o3HsDo1fEJ4SsZ4jeRQONpqb154fdyYRs7ZQDF8ZNLjvUBQbG+w1DfGC QM8y8xvAn1Eu6ZE/1wc4lUhaps5zteZl9U+bkpGbhqMbhmLtYsLg7xOQwgZUundq av7rQSDlTNbscYWQYo2s2k4pZeyoRIzp1GXfnus8O7Wmxp3U0D2fFbkktg2W3e/g EbqoMh3vgRrwSp6vIXuI0AxX3F21hg6L2RGn1EhqECIIb0YfIFs=3D =3D/Scf -----END PGP SIGNATURE----- --===============2247377934427124890== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCat6V2AAKCRCb9qggYcy5 IdLbAQDdQCM4baMskERSl10vU8b8U/DCPSGFo7I+bbRkN77cDQEA4F3hG+eU3FzR 0IExPJ6mYt8hAhVJNRB3MtJXxUSohQQ= =/xdF -----END PGP SIGNATURE----- --===============2247377934427124890==-- ]