Bug#1152054: starman: CVE-2026-115817 CVE-2026-115822 CVE-2026-115823 CVE-2026-115824

[Salvatore Bonaccorso]

Source: starman
Version: 0.4018-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerabilities were published for starman.

CVE-2026-115817[0]:
| Starman versions before 0.4019 for Perl allow a stalled request body
| to hold a worker indefinitely, as read_timeout covers only the
| headers.  Content-Length and chunked request bodies are read with
| blocking reads and no deadline. A client that sends complete headers
| and then stalls or trickles the body keeps the worker waiting until
| it disconnects.  A remote attacker can take every worker with a few
| such connections, five with the default worker count, so the server
| stops answering requests.  Version 0.4019 applies read_timeout to
| each wait for body data and adds a body_timeout limit, 300 seconds
| by default, on the total time to read a body.


CVE-2026-115822[1]:
| Starman versions before 0.4019 for Perl allow CPU exhaustion via
| quadratic regex backtracking when parsing chunked request bodies.
| Starman decodes chunked request bodies before calling the
| application, matching each chunk-size line with
| `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by
| a bare LF and then CRLF never matches, because `.` does not match
| LF, and each failed attempt backtracks in time quadratic in the
| length of the hex run. Nothing limits the length of the line.  A
| remote attacker can exhaust worker CPU by sending such requests to
| any route.


CVE-2026-115823[2]:
| Starman versions before 0.4019 for Perl send response bodies for
| HEAD requests, desynchronizing responses on keep-alive connections.
| For a HEAD request Starman omits chunked framing but still writes
| the body returned by the application, on both the array and
| streaming response paths. Responses with a 1xx, 204 or 304 status
| also carry the body.  On a keep-alive or pipelined connection the
| client reads those bytes as the start of the next response. A front-
| end proxy that reuses upstream connections may then pair responses
| with the wrong requests.


CVE-2026-115824[3]:
| Starman versions before 0.4019 for Perl allow memory exhaustion via
| unbounded buffering of chunked request bodies.  The chunked body
| decoder keeps each chunk in memory until the whole chunk and its
| CRLF have arrived, and sets no limit on the length of a chunk-size
| line. A client that declares a huge chunk size and streams data, or
| sends a chunk-size line that never ends, grows the buffer for as
| long as it keeps sending.  A remote attacker can exhaust worker
| memory with a single connection.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115817
    https://www.cve.org/CVERecord?id=CVE-2026-115817
[1] https://security-tracker.debian.org/tracker/CVE-2026-115822
    https://www.cve.org/CVERecord?id=CVE-2026-115822
[2] https://security-tracker.debian.org/tracker/CVE-2026-115823
    https://www.cve.org/CVERecord?id=CVE-2026-115823
[3] https://security-tracker.debian.org/tracker/CVE-2026-115824
    https://www.cve.org/CVERecord?id=CVE-2026-115824

Regards,
Salvatore