[From nobody Fri Oct 30 22:39:05 2026 Received: (at submit) by bugs.debian.org; 30 Oct 2026 19:59:29 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 23; hammy, 150; neutral, 141; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:52662) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xMsl6-005Qch-2Y for submit@bugs.debian.org; Fri, 30 Oct 2026 19:59:28 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=gCDiSIWOGwscP6xMrMZXgmZBJ66xSz45kf39sbaS8n8=; b=A/yC3P1Zh6syD7sjSKT8A8Sd6V K29QXeQ85VZKXVx/OF9VeCdcC/IzcnPq4+Gx0EJBrvZ+Dwk+XBbWDKi6ntFvrFzT5QQbExah7jN5A ia7u4BTg2pORfOEetmzYtUmyfhVcANy76yK/HNcvz6X6/w6j1Ybxa6+YNca5lJESTEUMcGSADOC2b s/CX4+Ks1x7nQxoSlo7y8W1HvraxDUoDFDvigXtoKLMfQ2q5MitCRRSa+pHx8/ATcgnnB70hDtUuw itiyOX0KzMuSDfbCMn0NVrlxOS/nahlb7I6UTLzMSLgGg6PL+ZFvA9Kres7lKGlSwYAqJv0TtlYRs nDHyv8Vw==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xMsl4-004421-1E for submit@bugs.debian.org; Fri, 30 Oct 2026 19:59:27 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id CE74BDC0384; Fri, 30 Oct 2026 20:59:25 +0100 (CET) Date: Fri, 30 Oct 2026 20:59:25 +0100 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: starlet: CVE-2026-116128 CVE-2026-116127 CVE-2026-115866 CVE-2026-115865 Message-ID: <auT3HcWEwuLgruzM@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: starlet Version: 0.32-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Hi, The following vulnerabilities were published for starlet. CVE-2026-116128[0]: | Starlet versions from 0.20 before 0.33 for Perl allow memory | exhaustion via unbounded buffering when decoding chunked request | bodies. The decoder adds each read to one buffer of unconsumed | input. Nothing limits the length of a chunk-size line, so a line | without a CRLF grows the buffer for as long as the client keeps | sending, and the read timeout restarts after every read. The data of | a large chunk is also held in the buffer until the whole chunk has | arrived. A remote attacker can exhaust a worker's memory with a | single request. CVE-2026-116127[1]: | Starlet versions before 0.33 for Perl send a body in responses to | HEAD requests, corrupting the next response on a persistent or | pipelined connection. The request method is not passed to the | response writer, so whatever body the application returns for a HEAD | request is sent. With Plack::Middleware::Head the body is empty, but | an HTTP/1.1 response without a Content-Length header still gets the | chunked encoding terminator. Responses with status 204 or 304 are | also sent with their body. Pipelined GET and HEAD requests keep the | connection open even when keep-alive is disabled, which is the | default. A client or proxy reading the connection takes the extra | bytes as the start of the next response, which may desynchronize a | proxy that shares the connection across clients. CVE-2026-115866[2]: | Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion | via regular expression backtracking when decoding chunked request | bodies. A chunk-size line is matched as a run of hex digits, then | .* and a CRLF. A run followed by a bare LF and then a CRLF can never | match, and the engine retries the match once for each digit, so the | time taken grows with the square of the run length. Nothing limits | the length of the run, which can span several reads. A remote | attacker can occupy a worker for about a minute of CPU time with one | 128 KiB request, before the application is called. CVE-2026-115865[3]: | Starlet versions before 0.33 for Perl allow a request declaring a | large Content-Length to kill a worker by exhausting memory. The | request body is read in a loop that asks sysread for all of the | remaining declared length at once. Perl grows the read buffer to | that size before any data arrives, so a length larger than available | memory makes the worker exit with an uncatchable out of memory error | before the application is called. A remote attacker can force a | worker restart with each request of a few bytes. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-116128 https://www.cve.org/CVERecord?id=CVE-2026-116128 [1] https://security-tracker.debian.org/tracker/CVE-2026-116127 https://www.cve.org/CVERecord?id=CVE-2026-116127 [2] https://security-tracker.debian.org/tracker/CVE-2026-115866 https://www.cve.org/CVERecord?id=CVE-2026-115866 [3] https://security-tracker.debian.org/tracker/CVE-2026-115865 https://www.cve.org/CVERecord?id=CVE-2026-115865 Regards, Salvatore ]