External risk intelligence

Starlet HEAD Response Body Desynchronization Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-116127

Starlet is a standalone HTTP server commonly used for Perl web applications. As a web server component exposed to handle incoming HTTP traffic, it is typically deployed as a public-facing service or an edge-facing interface to receive and process internet requests, making it likely to be reachable from the internet in common deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects web server software used for Perl applications, specifically related to how it handles certain types of requests. If exploited, it could allow an attacker to corrupt responses, potentially leading to inconsistent or incorrect data being served to users or other systems. The main concern is to confirm if your environment uses this specific software.

Web server sends bad data.
Could break subsequent requests.
Confirm if your Perl apps are impacted.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HEAD requests to a vulnerable server. Because the server improperly includes a response body with these requests, a subsequent response on the same connection can be corrupted. This corruption could lead to a desynchronization of the connection, potentially impacting other users if a shared connection is involved.

No authentication or user interaction needed.
Sending a HEAD request triggers the issue.
Corrupted responses can desynchronize connections.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity and availability of web services when using persistent or pipelined connections. Specifically, responses to HEAD requests may be malformed, causing subsequent responses on the same connection to be corrupted. This could lead to unexpected service behavior and desynchronization issues for shared connections, particularly in proxy environments.

Web service response integrity.
Malformed HEAD responses corrupt subsequent data.
Service availability and proxy desynchronization.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in Perl web applications. The first step should be to identify all instances of the affected technology, confirm their reachability and business criticality, and then determine the accountable owner to plan a risk-based remediation.

Application or platform owners.
Verify technology reachability and criticality.
Plan coordinated remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Starlet and how is it used?

Starlet is a lightweight, high-performance standalone HTTP server designed specifically for Perl web applications. Developers often use it as a persistent web server to handle incoming HTTP traffic, serving as the interface that bridges web requests to Perl-based application logic.

What is the CWE-444 vulnerability in CVE-2026-116127?

This CVE involves HTTP Request Smuggling, categorized as CWE-444. It occurs when a server fails to correctly process the boundaries of HTTP requests or responses. In this case, Starlet incorrectly sends a response body for HEAD requests—which should not contain one—causing the server and client to lose synchronization on where one response ends and the next begins.

How is this vulnerability triggered?

An attacker triggers this by sending a HEAD request to the server. The flaw relies on the use of persistent or pipelined connections, where multiple requests are sent over a single link. It does not occur if connections are closed immediately after each response, nor does it require authentication or complex user interaction.

Is my environment at risk for CVE-2026-116127?

If you use Starlet, Halo Surface Signal suggests your risk depends on how the server is deployed. Because Starlet is typically placed as an edge-facing interface to process incoming traffic, it is often reachable from the internet. Environments using proxies or load balancers that maintain persistent connections with backend Starlet instances are particularly susceptible to this desynchronization.

How do I respond to this threat?

Start by auditing your infrastructure to locate all Perl applications running Starlet versions older than 0.33. Once identified, evaluate whether these services share connections with proxies or other clients. Prioritize updating the affected software components to the latest version to ensure correct HTTP response handling.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.