========================================================================
CVE-2026-115822                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-115822

   Distribution:  Starman
       Versions:  before 0.4019
       MetaCPAN:  https://metacpan.org/dist/Starman
       VCS Repo:  https://github.com/miyagawa/Starman

Starman versions before 0.4019 for Perl allow CPU exhaustion via
quadratic regex backtracking when parsing chunked request bodies

Description
-----------
Starman versions before 0.4019 for Perl allow CPU exhaustion via
quadratic regex backtracking when parsing chunked request bodies.

Starman decodes chunked request bodies before calling the application,
matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A
line of hex digits followed by a bare LF and then CRLF never matches,
because `.` does not match LF, and each failed attempt backtracks in
time quadratic in the length of the hex run. Nothing limits the length
of the line.

A remote attacker can exhaust worker CPU by sending such requests to
any route.

Problem types
-------------
- CWE-1333 Inefficient Regular Expression Complexity

Solutions
---------
Upgrade to Starman 0.4019 or later.

References
----------
https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch
https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes