FKIE_CVE-2026-40560

Vulnerability from fkie_nvd - Published: 2026-04-29 00:16 - Updated: 2026-07-24 21:10
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
References
9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3Third Party Advisory
9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://github.com/miyagawa/Starman/commit/ced205f0805027e9d9c0731f8c40b104220604ed.patchPatch, Third Party Advisory
9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/MIYAGAWA/Starman-0.4018/changesProduct, Release Notes
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2026/04/29/1Mailing List, Third Party Advisory
Impacted products
Vendor Product Version
miyagawa starman *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Starman",
          "product": "Starman",
          "programFiles": [
            "lib/Starman/Server.pm"
          ],
          "programRoutines": [
            {
              "name": "Starman::Server::_prepare_env"
            }
          ],
          "repo": "https://github.com/miyagawa/Starman",
          "vendor": "MIYAGAWA",
          "versions": [
            {
              "lessThan": "0.4018",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:miyagawa:starman:*:*:*:*:*:perl:*:*",
              "matchCriteriaId": "0EF9D50C-F89F-432C-BD1D-E3D17A062046",
              "versionEndExcluding": "0.4018",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.\n\nStarman incorrectly prioritizes \"Content-Length\" over \"Transfer-Encoding: chunked\" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.\n\nAn attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy."
    },
    {
      "lang": "es",
      "value": "Versiones de Starman anteriores a la 0.4018 para Perl permiten el Contrabando de Solicitudes HTTP a trav\u00e9s de una Precedencia Indebida de Encabezados.\n\nStarman prioriza incorrectamente \u0027Content-Length\u0027 sobre \u0027Transfer-Encoding: chunked\u0027 cuando ambos encabezados est\u00e1n presentes en una solicitud HTTP. Seg\u00fan RFC 7230 3.3.3, Transfer-Encoding debe tener precedencia.\n\nUn atacante podr\u00eda explotar esto para contrabandear solicitudes HTTP maliciosas a trav\u00e9s de un proxy inverso frontal."
    }
  ],
  "id": "CVE-2026-40560",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40560",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-29T13:30:17.148319Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-29T00:16:03.927",
  "references": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/miyagawa/Starman/commit/ced205f0805027e9d9c0731f8c40b104220604ed.patch"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/04/29/1"
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.