Starlet CVE-2026-40561

The vulnerability requires: (1) an HTTP request explicitly containing both Content-Length and Transfer-Encoding: chunked headers in the same request; (2) Starlet deployed behind a front-end reverse proxy or load balancer that implements RFC 7230 correctly and prioritizes Transfer-Encoding; (3) network path between the attacker and Starlet (can be direct or through proxy). Exploitation does not require authentication, user interaction, or Starlet-specific configuration-it occurs against default Starlet behavior. However, the attack is only effective in a multi-tier proxy architecture where the front-end and backend interpret headers inconsistently. Standalone Starlet deployments directly exposed to clients without an intervening proxy are not vulnerable to request smuggling in the classical sense, although they still violate RFC 7230 and reject such requests only after the patch.

While CVSS 5.3 with network vector and low attack complexity appears moderate, the EPSS score of 0.01% (percentile 0%) indicates extremely low exploitation probability in practice. The integrity impact (I:L) reflects request smuggling's potential to modify HTTP semantics, but the confidentiality and availability impacts are absent. The vulnerability requires a specific proxy chain topology (front-end proxy and Starlet backend with differing header precedence interpretations) and does not affect standalone Starlet deployments or proxies that correctly implement RFC 7230. No CISA KEV listing or public exploit code is reported, and the attack surface is further narrowed because it only manifests when both headers are explicitly sent-standard HTTP clients rarely construct such malformed requests. The low EPSS combined with absence of active exploitation data suggests this is a compliance/defense-in-depth issue rather than an urgent operational risk, unless the specific deployment pattern (Starlet behind a vulnerable proxy) is confirmed in an organization's infrastructure.

An attacker sends an HTTP request with both Content-Length: 3 and Transfer-Encoding: chunked headers to a reverse proxy (e.g., nginx, which correctly prioritizes Transfer-Encoding) that forwards the request to an unpatched Starlet backend. The proxy interprets the request body as three bytes, while Starlet incorrectly interprets it as chunked-encoded data spanning multiple frames. This creates a desynchronization: the proxy forwards what it believes is a complete request, but Starlet parses additional data that the proxy intended for the next request, allowing an attacker to inject a hidden HTTP request that the backend processes while the proxy logs and forwards a different request. No public exploit code is documented at the time of analysis.