External risk intelligence

Starman HEAD Request Desynchronization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-115823

Starman is a high-performance Perl web server frequently deployed as an application server or gateway to serve web applications and APIs. Because it is designed to handle HTTP requests directly from clients or front-end proxies in internet-facing web environments, the attack surface is commonly exposed to network traffic.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects Starman, a web server technology, by causing it to incorrectly send response data under specific conditions. This misbehavior can lead to responses being mismatched with their original requests, potentially impacting the integrity and confidentiality of data processed by applications using this server. The primary concern is to confirm if our environment utilizes this technology and is therefore exposed.

Server sends data incorrectly, mixing requests.
Affects web applications and APIs that are internet-facing.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HEAD requests to a server running a vulnerable version of Starman. Because the server incorrectly sends response bodies for these requests, especially on keep-alive connections, a front-end proxy that reuses connections might associate these unexpected bytes with a subsequent client request. This could lead to incorrect responses being served to legitimate users.

Accessible over the network.
Malicious HEAD requests sent.
Response desynchronization, data leakage.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could lead to request/response desynchronization on keep-alive connections when the Starman server incorrectly sends response bodies for HEAD requests. This issue may affect how subsequent requests are processed when a front-end proxy reuses upstream connections, potentially pairing responses with incorrect requests.

Web server request/response data.
Server sends incorrect data for HEAD requests.
Responses may be misdirected to unrelated requests.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified vulnerability in Starman impacts how it handles HEAD requests, potentially leading to response desynchronization on keep-alive connections. This could affect web application owners and platform teams responsible for the Starman deployment. The initial action should focus on discovering all instances of Starman, assessing their exposure and criticality, identifying the specific teams accountable for each instance, and then developing a targeted remediation plan based on the risk.

Identify responsible application owners.
Verify affected Starman instances.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Starman?

Starman is a high-performance web server built for Perl. Developers typically use it to host web applications and APIs, often placing it behind a front-end proxy. It is designed to handle HTTP traffic efficiently, making it a common choice for serving dynamic content in production environments.

How does CVE-2026-115823 cause desynchronization?

This vulnerability involves CWE-444, or HTTP Request Smuggling. Starman incorrectly includes response bodies for HEAD requests, which should only return headers. When using persistent keep-alive connections, these unexpected body bytes remain in the stream, causing the server to misalign the next response with the wrong incoming request.

When does this vulnerability trigger?

The issue occurs when Starman processes a HEAD request, a 1xx, 204, or 304 status response on a keep-alive or pipelined connection. It does not trigger if connections are closed immediately after each response, as there is no subsequent request for the extra data to corrupt.

Is my system at risk from this Starman issue?

According to Halo Surface Signal, Starman is often deployed in internet-facing environments to handle direct network traffic. If your instance is exposed to the internet or reachable by untrusted clients, the likelihood of an attacker triggering this desynchronization is higher compared to internal, isolated systems.

What should I do to address CVE-2026-115823?

Begin by auditing your infrastructure to locate all instances running Starman versions prior to 0.4019. Once identified, coordinate with the relevant application teams to prioritize these servers based on their exposure to external traffic and plan for an update to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.