Starman
Monthly
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.