kazuho Starlet up to 0.32 Decoder memory allocation

Summaryinfo

A vulnerability labeled as critical has been found in kazuho Starlet up to 0.32. This affects an unknown part of the component Decoder. Such manipulation leads to memory allocation. This vulnerability is listed as CVE-2026-116128. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in kazuho Starlet up to 0.32. Affected by this issue is an unknown part of the component Decoder. The manipulation with an unknown input leads to a memory allocation vulnerability. Using CWE to declare the problem leads to CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. Impacted is availability. CVE summarizes:

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived. A remote attacker can exhaust a worker's memory with a single request.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-116128 since 10/25/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.33 eliminates this vulnerability. Applying the patch f3472712fff64329a43d86368768d80b61714106 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• kazuho

Name

• Starlet

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32

Website

• Product: https://github.com/kazuho/Starlet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion