Bug 2564043 (CVE-2026-115866)

Summary: CVE-2026-115866 perl-starlet: Starlet: Denial of Service via regular expression backtracking
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Starlet. When decoding chunked request bodies, an inefficient regular expression can result in catastrophic backtracking when encountering malformed chunk-size lines. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request, causing excessive CPU consumption and leading to a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565490, 2565493, 2565497    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 14:03:18 UTC 
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.

A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.

A remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.