CVE-2026-40560

Katalog CVE

CVSS 7.5 · High EPSS 0,54%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada miyagawa starman. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

Rincian

Terbit di NVD

29 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/miyagawa/Starman/commit/ced205f0805027e9d9c0731f8c40b104220604ed.patch patch · advisory pihak ketiga
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/04/29/1 mailing list · advisory pihak ketiga
• https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes product · release notes