Upstream information
Description
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.
A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.
Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
SUSE Bugzilla entry: 1287694 [NEW] No SUSE Security Announcements cross referenced.List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2026-12276 |
SUSE Timeline for this CVE
CVE page created: Mon Oct 26 17:56:29 2026CVE page last modified: Thu Oct 29 21:55:58 2026