PT-2026-35863 · Miyagawa · Starman

Cpansec · Published 2026-04-28 · Updated 2026-04-29 · CVE-2026-40560

NVD

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.

Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.

An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-40560

Affected Products

Starman

References · 8

• https://github.com/miyagawa/Starman/commit/ced205f0805027e9d9c0731f8c40b104220604ed.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40560 · Security Note
• https://twitter.com/VulmonFeeds/status/2049352655156199746 · Twitter Post
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 · Note
• https://twitter.com/oss_security/status/2049328694762553644 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/29/1 · Note
• https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes · Note
• https://twitter.com/CVEnew/status/2049350421089825078 · Twitter Post