/ 
Starlet-0.10
Security Advisories (1)
CVE-2026-40561 (2026-05-03)

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

Changes for version 0.10

  • switch from alarm-based polling to select-based
  • use TCP_DEFER_ACCEPT on linux
  • performance tweaks

Modules

Starlet
a simple, high-performance PSGI/Plack HTTP server

Provides

Plack::Handler::Starlet
in lib/Plack/Handler/Starlet.pm
Plack::Server::Standalone::Prefork::Server::Starter
in lib/Plack/Server/Standalone/Prefork/Server/Starter.pm
Starlet::Server
in lib/Starlet/Server.pm

Other files