Bug 2560481 (CVE-2026-115817)

Summary: CVE-2026-115817 perl-starman: Starman: Denial of Service via stalled HTTP request bodies
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Starman. A remote attacker can cause a Denial of Service (DoS) by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked indefinitely waiting for data. By opening a small number of stalled connections, an attacker can exhaust all available worker processes and prevent the server from answering legitimate requests.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2562402, 2562405, 2562411    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-25 17:01:37 UTC 
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.

Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.

A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.

Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.