========================================================================
CVE-2026-116128                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116128

   Distribution:  Starlet
       Versions:  from 0.20 before 0.33
       MetaCPAN:  https://metacpan.org/dist/Starlet
       VCS Repo:  https://github.com/kazuho/Starlet

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion
via unbounded buffering when decoding chunked request bodies

Description
-----------
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion
via unbounded buffering when decoding chunked request bodies.

The decoder adds each read to one buffer of unconsumed input. Nothing
limits the length of a chunk-size line, so a line without a CRLF grows
the buffer for as long as the client keeps sending, and the read
timeout restarts after every read. The data of a large chunk is also
held in the buffer until the whole chunk has arrived.

A remote attacker can exhaust a worker's memory with a single request.

Problem types
-------------
- CWE-770 Allocation of Resources Without Limits or Throttling

Solutions
---------
Upgrade to Starlet 0.33 or later.

References
----------
https://github.com/kazuho/Starlet/commit/f3472712fff64329a43d86368768d80b61714106.patch
https://metacpan.org/release/KAZUHO/Starlet-0.33/changes