CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Summary
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Original description
The description as published by the source.
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-40561 starlet
- Ubuntu UBUNTU-CVE-2026-40561 starlet
References
- advisory github.com
- advisory metacpan.org
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web openwall.com
- web cpan.org
- web datatracker.ietf.org