Security Advisories (1)
CVE-2026-40561 (2026-05-03)

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

NAME

Starlet

SYNOPSIS

% start_server --port=80 -- plackup -s Starlet [options] your-app.psgi

or if you do not need hot deploy,

% plackup -s Starlet --port=80 [options] your-app.psgi

DESCRIPTION

Starlet is a standalone HTTP/1.0 server formerly known as Plack::Server::Standalone::Prefork and Plack::Server::Standalone::Prefork::Server::Starter.

The server supports following features, and is suitable for running HTTP application servers behind a reverse proxy.

- prefork and graceful shutdown using Parallel::Prefork

- hot deploy using Server::Starter

- fast HTTP processing using HTTP::Parser::XS (optional)

COMMAND LINE OPTIONS

In addition to the options supported by plackup, Starlet accepts following options(s).

--num-workers=#

number of worker processes (default: 10)

--timeout=#

seconds until timeout (default: 300)

--keepalive-timeout=#

timeout for persistent connections (default: 2)

--max-keepalive-reqs=#

max. number of requests allowed per single persistent connection. If set to one, persistent connections are disabled (default: 1)

--max-reqs-per-child=#

max. number of requests to be handled before a worker process exits (default: 100)

NOTES

If you are looking for a standalone preforking HTTP server, then you should really look at Starman. However if your all want is a simple HTTP server that runs behind a reverse proxy, this good old module still does what it used to.

SEE ALSO

Parallel::Prefork Starman Server::Starter

AUTHOR

Kazuho Oku

miyagawa

LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://www.perl.com/perl/misc/Artistic.html