Bug 2564059 (CVE-2026-116128)

Summary: CVE-2026-116128 perl-starlet: Starlet: Denial of Service via unbounded buffering in chunked request decoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Starlet. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) through memory exhaustion. The issue occurs because the server fails to restrict buffer sizes when decoding chunked HTTP request bodies, allowing unconsumed input to accumulate indefinitely without proper termination. By sending a specially crafted request, an attacker can exhaust worker memory, causing the application to crash or become unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565486, 2565487, 2565488    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 14:20:18 UTC 
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.

The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived.

A remote attacker can exhaust a worker's memory with a single request.