CVE-2026-40560
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Apr 29, 2026
CISA due date
—
The record
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | perl-Starman | 0 | 0.4018-1.1 |
Related vulnerabilities
- CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before… CWE-444
- CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-444
- CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. CWE-444
- CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns… CWE-444
- CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our… CWE-444
- CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it… CWE-444
- CVE-2026-85078 Sanic is an opensource python web server/framework. CWE-444
- CVE-2026-81356 Inconsistent interpretation of http requests ('http request/response smuggling') in… CWE-444