CVE-2026-116127
Last modified
CVE-2026-116127 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body. Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 0.33 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-116127?
How severe is CVE-2026-116127?
How do I fix CVE-2026-116127?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11612Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-116120A vulnerability was determined in NocoDB up to 2026.07.0. Th…5.6
- CVE-2026-116121A vulnerability was identified in NocoDB up to 2026.08.0. Th…3.7
- CVE-2026-116122A security flaw has been discovered in NocoDB up to 2026.07.…3.7
- CVE-2026-116123A weakness has been identified in NocoDB up to 2026.07.0. Th…3.7
- CVE-2026-116124A security vulnerability has been detected in GNOME libgsf u…6.3
- CVE-2026-116128Starlet versions from 0.20 before 0.33 for Perl allow memory…7.5
- CVE-2026-11613The Divi Ajax Filter plugin for WordPress is vulnerable to L…9.8
- CVE-2026-116130HTTP::Parser::XS versions before 0.18 for Perl truncate PATH…9.1
- CVE-2026-116131HTTP::Body versions before 1.23_01 for Perl allow memory and…6.5
- CVE-2026-116132HTTP::Body versions before 1.23_01 for Perl leave the tempor…7.1
- CVE-2026-116133HTTP::Body versions before 1.23_01 for Perl allow CPU exhaus…7.5
Are you affected by CVE-2026-116127?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST