CVE-2026-115823 MIYAGAWA CVE debrief

Who should care

Defenders responsible for Perl applications using Starman, especially those handling keep-alive connections, should assess exposure and prioritize verification and remediation. This includes verifying Starman server exposure and configuration, assessing potential for response desynchronization attacks, and updating Starman to version 0.4019 or later. Additionally, defenders should review compensating controls for exposed systems while remediation is being

Why it matters

CVE-2026-115823 is a critical vulnerability in Starman versions before 0.4019 for Perl, which causes response body desynchronization on keep-alive connections due to improper handling of HEAD requests. Defenders should prioritize verifying exposure of Starman servers, especially those handling keep-alive connections, and assess the potential for response desynchronization attacks.

• Response desynchronization attacks may occur due to improper handling of HEAD requests
• Potential for attackers to pair responses with wrong requests on keep-alive connections
• Verification of Starman server exposure and configuration is necessary
• Remediation requires updating Starman to version 0.4019 or later

Technical summary

Starman versions before 0.4019 for Perl improperly handle HEAD requests, sending response bodies without chunked framing. This can cause response desynchronization on keep-alive connections, potentially allowing attackers to pair responses with wrong requests. The vulnerability is critical, with a CVSS score of 9.1, and defenders should prioritize verifying exposure of Starman servers, especially those handling keep-alive connections. The issue is fixed in Starman version 0.4019 or later, and defenders should assess the potential for response desynchronization attacks.

Defensive priority

Defenders should prioritize verifying exposure of Starman servers, especially those handling keep-alive connections, and assess the potential for response desynchronization attacks.

Recommended defensive actions

• Verify Starman server exposure and configuration
• Assess potential for response desynchronization attacks
• Update Starman to version 0.4019 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its impact on keep-alive connections and potential for response desynchronization. The vulnerability is caused by Starman sending response bodies for HEAD requests without chunked framing. This issue affects Starman versions before 0.4019 for Perl. The CVE record was published on 2026-10-25T17:17:01.743Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.