========================================================================
CVE-2026-115866                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-115866

   Distribution:  Starlet
       Versions:  from 0.20 before 0.33
       MetaCPAN:  https://metacpan.org/dist/Starlet
       VCS Repo:  https://github.com/kazuho/Starlet

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion
via regular expression backtracking when decoding chunked request
bodies

Description
-----------
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion
via regular expression backtracking when decoding chunked request
bodies.

A chunk-size line is matched as a run of hex digits, then .* and a
CRLF. A run followed by a bare LF and then a CRLF can never match, and
the engine retries the match once for each digit, so the time taken
grows with the square of the run length. Nothing limits the length of
the run, which can span several reads.

A remote attacker can occupy a worker for about a minute of CPU time
with one 128 KiB request, before the application is called.

Problem types
-------------
- CWE-1333 Inefficient Regular Expression Complexity

Solutions
---------
Upgrade to Starlet 0.33 or later.

References
----------
https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch
https://metacpan.org/release/KAZUHO/Starlet-0.33/changes