Starman CVE-2026-40560

Exploitation requires Starman (version < 0.4018) to be deployed behind a front-end reverse proxy or load balancer that interprets the conflicting Content-Length and Transfer-Encoding: chunked headers differently than Starman does - this proxy/backend parsing disagreement is the essential precondition, not merely 'network access.' The attacker sends an unauthenticated HTTP request (PR:N, no user interaction) containing both a Transfer-Encoding: chunked body and a mismatched Content-Length. Limiting factors: a bare Starman with no fronting proxy that would re-parse the request is not smuggling-exploitable in the classic sense; the attack's success depends on the specific header-handling behavior of the deployed proxy, and proxies that reject or normalize dual-length requests neutralize it. There is no authentication or special user privilege requirement, but the deployment-topology dependency (vulnerable proxy pairing) is what makes real-world exploitation non-universal.

Signals are mixed and lean toward moderate, environment-dependent risk rather than an urgent, broadly exploitable emergency. The NVD CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), reflecting unauthenticated network reach and confidentiality impact from stealing smuggled requests. However, EPSS is only 0.02% (5th percentile) and CISA SSVC lists Exploitation: none, Automatable: yes, Technical Impact: partial - so while automation is feasible, no exploitation is currently observed and it is not on the KEV list. A key nuance the NVD vector understates: request smuggling is only practically exploitable when Starman is deployed behind a front-end proxy whose parsing disagrees with Starman's, which is a real limiting factor arguing for higher attack complexity than AC:L suggests. The NVD scoring of C:H/I:N is also debatable: smuggling typically enables request manipulation (integrity) as much as disclosure, and the vendor tags include both 'Information Disclosure' and 'Request Smuggling' - treat the impact profile as covering both confidentiality and integrity. Net: a legitimate patch-soon issue for internet-facing Perl stacks, not a drop-everything zero-day.

An attacker sends a single crafted POST to a public site fronted by a reverse proxy, including both Content-Length and Transfer-Encoding: chunked so the proxy frames the request one way while Starman frames it another. The trailing bytes Starman leaves in the connection buffer are prepended to the next legitimate user's request, letting the attacker poison that request, bypass front-end access controls, or capture victim data. No public exploit is identified at time of analysis, though the fix commit ships a proof-of-concept-style regression test demonstrating the desync behavior.