What is the CVSS score of CVE-2026-40560?

CVE-2026-40560 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Starman are affected by CVE-2026-40560?

Starman web server before version 0.4018 is vulnerable to HTTP request smuggling, which allows attackers to intercept and manipulate traffic flowing through reverse proxies, directly exposing user…. A patch is available.

How to fix or mitigate CVE-2026-40560?

Within 24 hours, conduct a rapid inventory of all Starman deployments and versions, specifically identifying systems running versions prior to 0.4018 that sit behind proxy infrastructure. Within 7 days, plan and execute a staged deployment of Starman 0.4018 across all affected systems, testing in pre-production first and executing production updates during low-traffic windows. Within 30 days, confirm 100% deployment completion, enable relevant proxy-layer request smuggling protections if available from your proxy vendor, and review logs for any indicators of smuggling attempts.

Starman CVE-2026-40560

HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-04-29 9b29abf9-4ab0-4765-b253-1875cd9b441e

Request Smuggling Information Disclosure Starman

7.5

CVSS 3.1 · Vendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Severity by source

Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Unauthenticated remote (AV:N/PR:N), but AC:H because success depends on a front-end proxy that parses the dual headers differently; smuggling enables both disclosure and request manipulation, so C:H/I:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).

CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 02:38 vuln.today

Analysis Generated

Jul 24, 2026 - 02:38 vuln.today

CVSS changed

Apr 29, 2026 - 14:38 NVD

7.5 (HIGH)

Patch released

Apr 29, 2026 - 08:30 nvd

Patch available

CVE Published

Apr 29, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.

Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.

An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

AnalysisAI

HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.

Technical ContextAI

Starman is a high-performance preforking PSGI/Plack HTTP server for Perl (CPE cpe:2.3:a:miyagawa:starman), widely used to run Perl web applications behind reverse proxies such as nginx or Apache. The flaw is a classic TE.CL / CL.TE request-smuggling condition rooted in CWE-444 (Inconsistent Interpretation of HTTP Requests). RFC 7230 §3.3.3 requires that when both Transfer-Encoding and Content-Length are present, Transfer-Encoding must take precedence and Content-Length must be ignored (or the message rejected). The vulnerable code in lib/Starman/Server.pm (_prepare_env) evaluated Content-Length first in an if/elsif chain, so a chunked body with a deliberately wrong Content-Length was framed by the CONTENT_LENGTH value rather than by chunk decoding. The fix (commit ced205f) reorders the logic so the $chunked branch is tested before the Content-Length branch, and adds regression test t/te_cl_precedence.t which sends a chunked 'Hello World' body with Content-Length: 5 and asserts the full body is read.

RemediationAI

Vendor-released patch: upgrade to Starman 0.4018 or later, which reorders header handling so Transfer-Encoding: chunked takes precedence over Content-Length (fix commit ced205f, changelog at https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes). On Debian/Ubuntu, apply the distribution's patched package rather than relying on the CPAN version. If you cannot upgrade immediately, the most effective compensating control is at the front-end reverse proxy: configure the proxy to normalize or reject ambiguous requests that contain both Content-Length and Transfer-Encoding headers (for example, drop such requests or strip Transfer-Encoding), and ensure the proxy does not forward chunked bodies to Starman in a way that lets the two parsers disagree - the trade-off is that legitimate but unusual chunked clients may be rejected. Additionally, avoid exposing Starman directly to untrusted networks without a hardening proxy. Review the oss-security notice http://www.openwall.com/lists/oss-security/2026/04/29/1 and VulDB entry https://vuldb.com/vuln/360091 for advisory detail.