CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
CVE-2026-40561- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2026-26806
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
EUVD-2026-26806- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2xqx-75wg-w86v
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header...
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
GHSA-2xqx-75wg-w86v- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
CVE-2026-40561- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
ALPINE-CVE-2026-40561- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
OSV
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
CVE-2026-40561- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
DEBIAN-CVE-2026-40561- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
- Record
UBUNTU-CVE-2026-40561- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0120 No score
Updated perl-Starlet packages fix security vulnerability
Starlet versions through 0.31 for Perl allow HTTP Request Smuggling via Improper Header Precedence. (CVE-2026-40561)
- Record
MGASA-2026-0120- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-starletAlpine:v3.23 |
before 0.32-r0 | 0.32-r0 |
perl-starletAlpine:v3.24 |
before 0.32-r0 | 0.32-r0 |
starletDebian:12 |
All versions, plus listed versions 0.31-20.31-30.32-1 |
None known |
starletDebian:13 |
before 0.31-2+deb13u1, plus listed versions 0.31-2 |
0.31-2+deb13u1 |
starletDebian:14 |
before 0.31-3, plus listed versions 0.31-2 |
0.31-3 |
perl-StarletMageia:9 |
before 0.310.0-4.1.mga9 | 0.310.0-4.1.mga9 |
starletUbuntu:16.04:LTS |
All versions, plus listed versions 0.25-10.26-10.28-1 |
None known |
starletUbuntu:18.04:LTS |
All versions, plus listed versions 0.31-1 |
None known |
starletUbuntu:20.04:LTS |
All versions, plus listed versions 0.31-1 |
None known |
starletUbuntu:22.04:LTS |
All versions, plus listed versions 0.31-1.1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
starletUbuntu:24.04:LTS |
All versions, plus listed versions 0.31-2 |
None known |
starletUbuntu:25.10 |
All versions, plus listed versions 0.31-2 |
None known |
starletUbuntu:26.10 |
All versions, plus listed versions 0.31-2build10.31-30.32-1 |
None known |
starletUbuntu:26.04:LTS |
All versions, plus listed versions 0.31-20.31-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40561 is a medium vulnerability (CVSS 5.3) in Kazuho Starlet, published May 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in perl-starlet 0.32-r0.
References
datatracker.ietf.org/doc/html/rfc7230
github.com/kazuho/Starlet/commit/a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0.patch
metacpan.org/release/KAZUHO/Starlet-0.32/changes
openwall.com/lists/oss-security/2026/05/03/1
nvd.nist.gov/vuln/detail/CVE-2026-40561
Show 10 moreShow less
security.alpinelinux.org/vuln/CVE-2026-40561
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-40561
advisories.mageia.org/MGASA-2026-0120.html
bugs.mageia.org/show_bug.cgi?id=35464
ubuntu.com/security/CVE-2026-40561
cve.org/CVERecord?id=CVE-2026-40561
lists.security.metacpan.org/cve-announce/msg/39593408