All errata/sisyphus_e2k/ALT-PU-2026-7799-1
ALT-PU-2026-7799-1

Package update starman in branch sisyphus_e2k

Version0.4018-alt1
Task#0
Published2026-05-13
Max severityHIGH
Severity:

Closed issues (1)

CVE-2026-40560
HIGH7.5

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

Published: 2026-04-28Modified: 2026-06-17
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N