Most recent entries from all

EUVD-2026-309067

2026-10-03T12:00:39.516804+00:00

EUVD-2026-309067

fkie_cve-2026-40561

2026-10-03T12:00:39.516839+00:00

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.

Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.

An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

GHSA-2xqx-75wg-w86v

2026-10-03T12:00:39.516875+00:00

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.

Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.

An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

UBUNTU-CVE-2026-40561

2026-10-03T12:00:39.516895+00:00

Affected: Ubuntu:16.04:LTS: starlet, Ubuntu:18.04:LTS: starlet, Ubuntu:20.04:LTS: starlet, Ubuntu:22.04:LTS: starlet, Ubuntu:24.04:LTS: starlet, Ubuntu:25.10: starlet, Ubuntu:26.04:LTS: starlet

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.