CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Résumé
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-40561 starlet
- Ubuntu UBUNTU-CVE-2026-40561 starlet
Références
- advisory github.com
- advisory metacpan.org
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web openwall.com
- web cpan.org
- web datatracker.ietf.org