CVE-2026-115822 MIYAGAWA CVE debrief

Who should care

Defenders responsible for systems using Starman for Perl should assess exposure to this vulnerability and prioritize verification and potential upgrades. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review system configurations, monitor for suspicious traffic, and implement additional security measures to prevent similar attacks. The potential impact of this vulnerability on infrastructure

Why it matters

CVE-2026-115822 is a high-severity vulnerability in Starman for Perl, allowing remote attackers to cause CPU exhaustion via specially crafted requests. Defenders should prioritize verifying exposure, especially in systems using Starman, and assess potential impact on infrastructure.

• CPU exhaustion can lead to denial of service
• Remote attackers can trigger this vulnerability with specially crafted requests
• Verification of Starman version and system configurations is necessary

Technical summary

The vulnerability exists in Starman versions before 0.4019 for Perl, where the decoding of chunked request bodies can lead to quadratic regex backtracking, causing CPU exhaustion. This is due to the regex pattern `s/^(([0-9a-fA-F]+).*015012)//` used to match chunk-size lines, which can backtrack in time quadratically with the length of the hex run if a line of hex digits is followed by a bare LF and then CRLF.

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability, especially in systems using Starman for Perl, and assess the potential impact on their infrastructure.

Recommended defensive actions

• Verify Starman version and upgrade to 0.4019 or later if necessary
• Review system configurations and monitor for suspicious traffic
• Implement additional security measures to prevent similar attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code changes and release notes. The CVE record was published on 2026-10-25T17:17:01.637Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its severity and potential impact. However, the exact scope of affected systems and the extent of potential damage are not explicitly stated, requiring defenders to verify exposure and assess potential

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.