Bug 2562410

Summary: CVE-2026-115823 perl-Starman: perl-starman: HTTP response desynchronization via improper response body handling [fedora-rawhide]
Product: [Fedora] Fedora Reporter: Oleg Sushchenko <osushche>
Component: perl-StarmanAssignee: Emmanuel Seyman <emmanuel>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: emmanuel, perl-devel
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["2afd45e0-2102-4e3c-8413-d1e717386f08"]}
Fixed In Version: perl-Starman-0.4019-1.fc46 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-28 08:26:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2560478    

Description Oleg Sushchenko 2026-10-27 20:41:02 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.

For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.

On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Comment 1 Emmanuel Seyman 2026-10-28 08:26:38 UTC 
Built a few days for rawhide:
https://koji.fedoraproject.org/koji/buildinfo?buildID=3127672