Hi,

The following vulnerabilities were published for starlet.

CVE-2026-116128[0]:
| Starlet versions from 0.20 before 0.33 for Perl allow memory
| exhaustion via unbounded buffering when decoding chunked request
| bodies.  The decoder adds each read to one buffer of unconsumed
| input. Nothing limits the length of a chunk-size line, so a line
| without a CRLF grows the buffer for as long as the client keeps
| sending, and the read timeout restarts after every read. The data of
| a large chunk is also held in the buffer until the whole chunk has
| arrived.  A remote attacker can exhaust a worker's memory with a
| single request.


CVE-2026-116127[1]:
| Starlet versions before 0.33 for Perl send a body in responses to
| HEAD requests, corrupting the next response on a persistent or
| pipelined connection.  The request method is not passed to the
| response writer, so whatever body the application returns for a HEAD
| request is sent. With Plack::Middleware::Head the body is empty, but
| an HTTP/1.1 response without a Content-Length header still gets the
| chunked encoding terminator. Responses with status 204 or 304 are
| also sent with their body.  Pipelined GET and HEAD requests keep the
| connection open even when keep-alive is disabled, which is the
| default. A client or proxy reading the connection takes the extra
| bytes as the start of the next response, which may desynchronize a
| proxy that shares the connection across clients.


CVE-2026-115866[2]:
| Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion
| via regular expression backtracking when decoding chunked request
| bodies.  A chunk-size line is matched as a run of hex digits, then
| .* and a CRLF. A run followed by a bare LF and then a CRLF can never
| match, and the engine retries the match once for each digit, so the
| time taken grows with the square of the run length. Nothing limits
| the length of the run, which can span several reads.  A remote
| attacker can occupy a worker for about a minute of CPU time with one
| 128 KiB request, before the application is called.


CVE-2026-115865[3]:
| Starlet versions before 0.33 for Perl allow a request declaring a
| large Content-Length to kill a worker by exhausting memory.  The
| request body is read in a loop that asks sysread for all of the
| remaining declared length at once. Perl grows the read buffer to
| that size before any data arrives, so a length larger than available
| memory makes the worker exit with an uncatchable out of memory error
| before the application is called.  A remote attacker can force a
| worker restart with each request of a few bytes.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-116128
https://www.cve.org/CVERecord?id=CVE-2026-116128
[1] https://security-tracker.debian.org/tracker/CVE-2026-116127
https://www.cve.org/CVERecord?id=CVE-2026-116127
[2] https://security-tracker.debian.org/tracker/CVE-2026-115866
https://www.cve.org/CVERecord?id=CVE-2026-115866
[3] https://security-tracker.debian.org/tracker/CVE-2026-115865
https://www.cve.org/CVERecord?id=CVE-2026-115865

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
starlet, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152634@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated starlet package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 30 Oct 2026 23:17:52 CET
Source: starlet
Binary:
Architecture: source
Version: 0.33-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Description:
Closes: 1152634
Changes:
 starlet (0.33-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 0.33.
     Contains fixes for CVE-2026-116128 CVE-2026-116127 CVE-2026-115866
     CVE-2026-115865.
     Closes: #1152634
   * Convert debian/watch to version 5.
Checksums-Sha256:
 4ad919f6f0120ded88eecf66fbb5014824173a41509c6b6989c9f339984b3182 2284 starlet_0.33-1.dsc
 2da69bb608a9ab08630a3c189b466f7f36681173270be17a89e7e2840d6074fb 114503 starlet_0.33.orig.tar.gz
 ac22a8734f5171b14f6647d17858d9f60d41c0965d27d92b7a4a65c8d5ae68f5 3852 starlet_0.33-1.debian.tar.xz
 eb1b62cb36fde315eec68e88fb9c7e29948674d3a902479b993532501b5b79f9 7742 starlet_0.33-1_sourceonly.buildinfo
Checksums-Sha1:
 7e38a389e853fba9a724ef50bee2c382b288ca57 2284 starlet_0.33-1.dsc
 13631394bea10d2f8e2f0bd8d0300f25ae6cd52d 114503 starlet_0.33.orig.tar.gz
 81de3c8b9dc9f94ff54f26790f4e5e58bd805171 3852 starlet_0.33-1.debian.tar.xz
 31c39941c996109cc0fa6aedce357263dc67e50e 7742 starlet_0.33-1_sourceonly.buildinfo
Files:
 dd0887724c6bcf6c628c9b7b1f5e9e86 2284 perl optional starlet_0.33-1.dsc
 9199bacbc2604532bf69f11db4558b83 114503 perl optional starlet_0.33.orig.tar.gz
 bb0d2d9a281e2cfc2ae6a5b5e7a92ec6 3852 perl optional starlet_0.33-1.debian.tar.xz
 858c77f76812a1442713d0e8fb8d4574 7742 - - starlet_0.33-1_sourceonly.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmrlF5BfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgZNXhAAxLoxidMSuI7Eqf3XI0WDoF6xaFJ77wyILVZo5sEQv5wseT+85sENhdKH
rGAfouEnjMKo1Xw0gBd1L9AwUC638QrBW92Z9iqovlW48Nx23O+V4cCtnQpKALES
XoeD+37KV8BXASFbRAtLRzbVGgpXpcBQXSYoIBi4IOp0l2mNFZkWYXd4smT5sHfA
E1csdR135MLDQf9sRRUza+J2vQELqdZd9FM8p/xuKh29JP5Y4wgqkY2ZY2Z1LuT0
NapUdHr+XfCzqjqO+91t+YL1h9jE+zHSg2ZS7c9lVxjbM6q32VgICxbfkr5p+Eu7
Ytn6Smyrwa7g7u5uUYT8CW0+T8kerkpqO8SKPQlQvWjiIvSRoMpeAaREYqR23bSq
8paKWY1A2pVlwS7EdRWnOWQRONQUf8f9DvIau1qZ7Kfk/HUOnq9U5cCIDFzUPzK4
ErRCrjN1yt3R1RDseOjJoO9x3XcZMZh5yZoz7aJ8DBti1ObWLKczpYbcpDUtA84y
VK7ieLekQBUEiJIGcvV87E27RVse96YdRPWcsmUFviNlnIndUsYo4hAaRiUHuyQg
jzyiJsv6T4E0f40oqJ0ug22/eKQCrcE68sqkd7KZgCRaPt4VbZegZKTyhdUYmyFt
OszDJiqZtN8ineJe2wL4pvQvulcVJoLHx7v/9tmXRBa0JRzBVDU=
=pxpl
-----END PGP SIGNATURE-----