Hi,

The following vulnerabilities were published for starman.

CVE-2026-115817[0]:
| Starman versions before 0.4019 for Perl allow a stalled request body
| to hold a worker indefinitely, as read_timeout covers only the
| headers.  Content-Length and chunked request bodies are read with
| blocking reads and no deadline. A client that sends complete headers
| and then stalls or trickles the body keeps the worker waiting until
| it disconnects.  A remote attacker can take every worker with a few
| such connections, five with the default worker count, so the server
| stops answering requests.  Version 0.4019 applies read_timeout to
| each wait for body data and adds a body_timeout limit, 300 seconds
| by default, on the total time to read a body.


CVE-2026-115822[1]:
| Starman versions before 0.4019 for Perl allow CPU exhaustion via
| quadratic regex backtracking when parsing chunked request bodies.
| Starman decodes chunked request bodies before calling the
| application, matching each chunk-size line with
| `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by
| a bare LF and then CRLF never matches, because `.` does not match
| LF, and each failed attempt backtracks in time quadratic in the
| length of the hex run. Nothing limits the length of the line.  A
| remote attacker can exhaust worker CPU by sending such requests to
| any route.


CVE-2026-115823[2]:
| Starman versions before 0.4019 for Perl send response bodies for
| HEAD requests, desynchronizing responses on keep-alive connections.
| For a HEAD request Starman omits chunked framing but still writes
| the body returned by the application, on both the array and
| streaming response paths. Responses with a 1xx, 204 or 304 status
| also carry the body.  On a keep-alive or pipelined connection the
| client reads those bytes as the start of the next response. A front-
| end proxy that reuses upstream connections may then pair responses
| with the wrong requests.


CVE-2026-115824[3]:
| Starman versions before 0.4019 for Perl allow memory exhaustion via
| unbounded buffering of chunked request bodies.  The chunked body
| decoder keeps each chunk in memory until the whole chunk and its
| CRLF have arrived, and sets no limit on the length of a chunk-size
| line. A client that declares a huge chunk size and streams data, or
| sends a chunk-size line that never ends, grows the buffer for as
| long as it keeps sending.  A remote attacker can exhaust worker
| memory with a single connection.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115817
https://www.cve.org/CVERecord?id=CVE-2026-115817
[1] https://security-tracker.debian.org/tracker/CVE-2026-115822
https://www.cve.org/CVERecord?id=CVE-2026-115822
[2] https://security-tracker.debian.org/tracker/CVE-2026-115823
https://www.cve.org/CVERecord?id=CVE-2026-115823
[3] https://security-tracker.debian.org/tracker/CVE-2026-115824
https://www.cve.org/CVERecord?id=CVE-2026-115824

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
starman, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152054@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated starman package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 26 Oct 2026 00:21:19 +0100
Source: starman
Architecture: source
Version: 0.4019-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1152054
Changes:
 starman (0.4019-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 0.4019.
     - Stream chunked request bodies to the temporary buffer instead of holding
       whole chunks in memory (CVE-2026-115824)
     - Parse chunk-size lines in linear time with a 4 KiB length limit and
       strict syntax; malformed lines get 400 (CVE-2026-115822)
     - Do not send a response body for HEAD requests or 1xx, 204 and 304
       responses, on both the array and streaming paths (CVE-2026-115823)
     - Limit how long a request body may take to arrive: --read-timeout
       (default 5 seconds) now also applies to each wait for more of the body,
       and the new --body-timeout option limits the total time (default 300
       seconds; raise it or set it to 0 for slower uploads). Expiry gets 408
       (CVE-2026-115817)
     Closes: #1152054
   * Mention behaviour changes in debian/NEWS.Developer.
   * Update test dependencies.
   * Convert debian/watch to version 5.
Checksums-Sha1:
 eb625ffa40192b369c2f49c3a9ccce39eb9859b0 2580 starman_0.4019-1.dsc
 8f8e18d4e275df8641256a3516069dcb7060d2d7 45120 starman_0.4019.orig.tar.gz
 1623e3eaade4859cd347b976c27fb6ef5105a7a7 4808 starman_0.4019-1.debian.tar.xz
 9d20d9380ee2174f00978bccb8a0981812f3cebb 105876 starman_0.4019-1.git.tar.xz
 075ca65d25cedaf8ca743d3160ed10aaf7f963e0 17736 starman_0.4019-1_source.buildinfo
Checksums-Sha256:
 68b4e7a3acace09ba89ed5de95338a3e7f8d1eae04cf8484b6a1edb07803041f 2580 starman_0.4019-1.dsc
 4a33f20a6a3250938fc85e21779e34c56e156895fe4a8fa8c83ac4e96ecaef61 45120 starman_0.4019.orig.tar.gz
 4503e0b720a6ba6e73134a92b7dd5b8e795bfbdc627cc956f95ea724193501e5 4808 starman_0.4019-1.debian.tar.xz
 a5da90b7dbdc0935a99cef1c467f0794293237a118f1e6d976c6abf601f2742e 105876 starman_0.4019-1.git.tar.xz
 7f4c1308d5c4c5ef89a601ffe3c7c0d34d8271f426cfa2630d9c37dde2a81f5e 17736 starman_0.4019-1_source.buildinfo
Files:
 68afdfa5ce6cad728f37790a748f3c2c 2580 perl optional starman_0.4019-1.dsc
 b172f13b7c20b46e1499b07a91b69e4e 45120 perl optional starman_0.4019.orig.tar.gz
 1e36d2b2ff9d5b20b35bcf18e662b2ba 4808 perl optional starman_0.4019-1.debian.tar.xz
 211930932dfeab1beb41a71943027d37 105876 perl None starman_0.4019-1.git.tar.xz
 a52615d1040124e4a7453a37967212d7 17736 perl optional starman_0.4019-1_source.buildinfo
Git-Tag-Info: tag=4a247424f4d0e3ca2abb34f4560f29dc483b78b9 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrekA4ACgkQYG0ITkaD
wHmNChAA7dFs8pa0yUnWFQpYfJnEJMJ9BbIoCrZNEXA1tpyuaerRpBaIHr6KzcVj
BzzWoI0NhOX5jzFkeq9YAubR+GwBdakQzsdYHQ7m1ZASaJYMtVnrE5naAAxhO4nC
HUH0fVhM+ppJIiuXm17AvHddHYYm9Q5onQgB6IOf2qGlYcWqEaCH2R742x3fhZ5+
hdgEPP8r6p+eveLgU1mV0kir0VFaxGInuQ5lIXJVCUecYH0KPOqCotuNo4TGD+hI
7mJUUX/6nN4+Js0ru/NHiaFN1BQy5RxGEoUMWsUlOJCzapsNxVNqaWo22bM75iAG
Fp8kHYwRK5cmOFIYJTr+vbx6SjSNnlhEzj8OHedDFNExF5v2FEJnZXfEEg8TFP6l
PGFHe8Cbc9OdCcbh70RYqa/aqhBRTEr4M2Sqp+E/otdz9EIh5cIkBPrev7YZbQGd
EXq6pCb9o3HsDo1fEJ4SsZ4jeRQONpqb154fdyYRs7ZQDF8ZNLjvUBQbG+w1DfGC
QM8y8xvAn1Eu6ZE/1wc4lUhaps5zteZl9U+bkpGbhqMbhmLtYsLg7xOQwgZUundq
av7rQSDlTNbscYWQYo2s2k4pZeyoRIzp1GXfnus8O7Wmxp3U0D2fFbkktg2W3e/g
EbqoMh3vgRrwSp6vIXuI0AxX3F21hg6L2RGn1EhqECIIb0YfIFs=
=/Scf
-----END PGP SIGNATURE-----