Debian/starman: unknown

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

osv: DEBIAN-CVE-2026-115822#Debian:13/starman
https://security-tracker.debian.org/tracker/CVE-2026-115822

published 2026-10-25T17:17:01.637Z · modified 2026-10-29T23:00:07.844234673Z · JSON