[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2aff9aefaaf12148bbfd43af480ab8f4@cpansec.org>
Date: Tue, 28 Apr 2026 20:53:09 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2026-40560: Starman versions before 0.4018 for Perl allows HTTP
Request Smuggling via Improper Header Precedence
========================================================================
CVE-2026-40560 CPAN Security Group
========================================================================
CVE ID: CVE-2026-40560
Distribution: Starman
Versions: before 0.4018
MetaCPAN: https://metacpan.org/dist/Starman
VCS Repo: https://github.com/miyagawa/Starman
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling
via Improper Header Precedence
Description
-----------
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling
via Improper Header Precedence.
Starman incorrectly prioritizes "Content-Length" over
"Transfer-Encoding: chunked" when both headers are present in an HTTP
request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a
front-end reverse proxy.
Problem types
-------------
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP
Request/Response Smuggling')
Solutions
---------
Upgrade to version 0.4018
References
----------
https://github.com/miyagawa/Starman/commit/ced205f0805027e9d9c0731f8c40b104220604ed.patch
https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes
https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
Timeline
--------
- 2027-04-12: Issue identified by CPANSec
- 2027-04-27: Issue reported to software maintainer
- 2027-04-27: Fix committed to public Github repository
- 2027-04-27: Updated version uploaded to CPAN
Credits
-------
CPANSec, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
