CVE-2026-40561

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada kazuho starlet. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

Rincian

Terbit di NVD

3 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kazuho/Starlet/commit/a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0.patch patch
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/05/03/1 mailing list · advisory pihak ketiga
• https://metacpan.org/release/KAZUHO/Starlet-0.32/changes