{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"starlet","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M67EEJCCJ897KS1CNZ3G5XRC","modified_at":"2026-11-02T22:00:07.698561614Z","published_at":"2026-10-30T13:18:31.293Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-116128","https://security-tracker.debian.org/tracker/CVE-2026-116128"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-116128#Debian:13/starlet","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-116128"}],"summary":"Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Noth"}