{"id":"CVE-2026-115866","aliases":[],"cve":{"records":[{"id":"CVE-2026-115866","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T17:41:34.521Z","published":"2026-10-30T12:45:39.814Z","modified":"2026-10-30T12:45:39.814Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-30T12:45:39.814Z"}],"references":[{"url":"https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://metacpan.org/release/KAZUHO/Starlet-0.33/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-1333","description":"CWE-1333 Inefficient Regular Expression Complexity","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\n\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\n\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.","score":null,"severity":"unknown","published":"2026-10-30T12:45:39.814Z","modified":"2026-10-30T12:45:39.814Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Starlet","platforms":[],"versions":[{"version":"0.20","status":"affected","lessThan":"0.33","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Starlet","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-115866"}],"remediation":[{"text":"Upgrade to Starlet 0.33 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-115866"}],"references":["https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch","https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"],"sources":[{"name":"CVE","id":"CVE-2026-115866","modified":"2026-10-30T12:45:39.814Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115866"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T13:08:40.051Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T13:20:32.417Z","attemptedAt":"2026-10-30T13:20:32.417Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T13:20:32.417Z","attemptedAt":"2026-10-30T13:20:32.417Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T13:20:32.417Z","attemptedAt":"2026-10-30T13:20:32.417Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T13:20:32.417Z","attemptedAt":"2026-10-30T13:20:32.417Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113907","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113907","modified":"Oct 30, 2026, 12:45:39 PM","checkedAt":"2026-10-30T13:20:32.417Z"},{"source":"NVD","id":"CVE-2026-115866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115866","modified":"2026-10-30T13:18:31.070","checkedAt":"2026-10-30T13:20:32.417Z"}],"aiSummary":{"text":"Starlet versions 0.20 before 0.33 for Perl are vulnerable to CPU exhaustion via regular expression backtracking when decoding chunked request bodies, allowing a remote attacker to occupy a worker for about a minute of CPU time. The weakness is due to inefficient regular expression complexity. A remote attacker can exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T13:11:04.615Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115866"}]}}