CVE-2026-115866
Last modified
CVE-2026-115866 is a vulnerability of currently unknown severity. Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length.
Description
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads. A remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | >= 0.20, < 0.33 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-115866?
How severe is CVE-2026-115866?
How do I fix CVE-2026-115866?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-115840The VikRentCar Car Rental Management System plugin for WordP…7.2
- CVE-2026-115845An incomplete list of disallowed inputs in the Python code v…6.4
- CVE-2026-11585A vulnerability was determined in CodeAstro Student Attendan…6.3
- CVE-2026-11586By default, curl automatically responds to WebSocket PING fr…7.5
- CVE-2026-115863ConnMan through 2.0 has a stack-based buffer overflow via a …7.6
- CVE-2026-115865Starlet versions before 0.33 for Perl allow a request declar…
- CVE-2026-115869The Themify Builder plugin for WordPress is vulnerable to St…6.4
- CVE-2026-11587SQL injection allowing an authenticated user with access to …7.2
- CVE-2026-115877Twisted is an event-based framework for internet application…5.4
- CVE-2026-11588The EONSR AEO Agent WordPress plugin through 3.7.9 does not …6.1
- CVE-2026-115883LangGraph checkpoint savers provide Postgres- and SQLite-bac…6
- CVE-2026-115885The LangGraph CLI is the official command-line interface for…4.1
Are you affected by CVE-2026-115866?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST