{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"starman","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5THWH9QRK9YMJG5Y5B2G73K","modified_at":"2026-10-29T23:00:06.728246168Z","published_at":"2026-10-25T17:17:01.853Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-115824","https://security-tracker.debian.org/tracker/CVE-2026-115824"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-115824#Debian:13/starman","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-115824"}],"summary":"Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRL"}