========================================================================
CVE-2026-115865                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-115865

   Distribution:  Starlet
       Versions:  before 0.33
       MetaCPAN:  https://metacpan.org/dist/Starlet
       VCS Repo:  https://github.com/kazuho/Starlet

Starlet versions before 0.33 for Perl allow a request declaring a large
Content-Length to kill a worker by exhausting memory

Description
-----------
Starlet versions before 0.33 for Perl allow a request declaring a large
Content-Length to kill a worker by exhausting memory.

The request body is read in a loop that asks sysread for all of the
remaining declared length at once. Perl grows the read buffer to that
size before any data arrives, so a length larger than available memory
makes the worker exit with an uncatchable out of memory error before
the application is called.

A remote attacker can force a worker restart with each request of a few
bytes.

Problem types
-------------
- CWE-789 Memory Allocation with Excessive Size Value

Solutions
---------
Upgrade to Starlet 0.33 or later.

References
----------
https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782.patch
https://metacpan.org/release/KAZUHO/Starlet-0.33/changes