{"id":"DEBIAN-CVE-2026-115865","details":"Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.  The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.  A remote attacker can force a worker restart with each request of a few bytes.","modified":"2026-10-31T06:00:08.699429228Z","published":"2026-10-30T13:18:30.947Z","upstream":["CVE-2026-115865"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-115865"}],"affected":[{"package":{"name":"starlet","ecosystem":"Debian:12","purl":"pkg:deb/debian/starlet?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.31-2","0.31-3","0.32-1","0.33-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115865.json"}},{"package":{"name":"starlet","ecosystem":"Debian:13","purl":"pkg:deb/debian/starlet?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.31-2","0.31-2+deb13u1","0.31-3","0.32-1","0.33-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115865.json"}},{"package":{"name":"starlet","ecosystem":"Debian:14","purl":"pkg:deb/debian/starlet?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.31-2","0.31-3","0.32-1","0.33-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115865.json"}}],"schema_version":"1.9.2"}