Bug 2564024 (CVE-2026-115865)

Summary: CVE-2026-115865 perl-starlet: perl-starlet: Denial of Service via large Content-Length header
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-starlet. When processing incoming HTTP requests, the server preallocates memory for the entire declared payload size before receiving the request body. A remote attacker can send an HTTP request with an excessively large Content-Length header, causing the application to exhaust available memory and terminate worker processes, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565494, 2565496, 2565499    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 13:47:06 UTC 
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.

The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.

A remote attacker can force a worker restart with each request of a few bytes.