Bug 2562407

Summary: CVE-2026-115823 perl-Starman: perl-starman: HTTP response desynchronization via improper response body handling [fedora-44]
Product: [Fedora] Fedora Reporter: Oleg Sushchenko <osushche>
Component: perl-StarmanAssignee: Emmanuel Seyman <emmanuel>
Status: ON_QA --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 44CC: emmanuel, perl-devel
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["2afd45e0-2102-4e3c-8413-d1e717386f08"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2560478    

Description Oleg Sushchenko 2026-10-27 20:39:47 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.

For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.

On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Comment 1 Fedora Update System 2026-10-28 08:22:00 UTC 
FEDORA-2026-2106e35a84 (perl-Starman-0.4019-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-2106e35a84
Comment 2 Fedora Update System 2026-10-29 02:46:49 UTC 
FEDORA-2026-2106e35a84 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-2106e35a84`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-2106e35a84

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.