========================================================================
CVE-2026-115823                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-115823

   Distribution:  Starman
       Versions:  before 0.4019
       MetaCPAN:  https://metacpan.org/dist/Starman
       VCS Repo:  https://github.com/miyagawa/Starman

Starman versions before 0.4019 for Perl send response bodies for HEAD
requests, desynchronizing responses on keep-alive connections

Description
-----------
Starman versions before 0.4019 for Perl send response bodies for HEAD
requests, desynchronizing responses on keep-alive connections.

For a HEAD request Starman omits chunked framing but still writes the
body returned by the application, on both the array and streaming
response paths. Responses with a 1xx, 204 or 304 status also carry the
body.

On a keep-alive or pipelined connection the client reads those bytes as
the start of the next response. A front-end proxy that reuses upstream
connections may then pair responses with the wrong requests.

Problem types
-------------
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP
   Request/Response Smuggling')

Workarounds
-----------
For deployments that cannot upgrade to 0.4019, enable
Plack::Middleware::Head, which removes the body from HEAD responses.

Solutions
---------
Upgrade to Starman 0.4019 or later.

References
----------
https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch
https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes