Starman for Perl performs blocking reads when processing a request body and applies a read timeout only to header parsing, leaving no deadline for the body. An attacker can send a well‑formed header set and then stall or slowly transmit the body, causing worker processes to wait for the remaining data until the client disconnects. Because each stalled connection keeps a worker occupied indefinitely, an attacker can rapidly exhaust the entire worker pool and halt all service responses.

The flaw affects every release of Starman for Perl older than 0.4019. Deployments that use the default worker count of five are particularly vulnerable, as an attacker can open only a handful of stalled connections to occupy all workers and stop the server from handling any additional requests.

No CVSS score is publicly disclosed and the EPSS score is unavailable. Starman is not listed in the CISA KEV catalog. The attack vector is remote; an attacker only needs to send HTTP requests to the vulnerable host. Because saturation can occur with a very small number of connections, the threat is significant for any publicly reachable Starman instance running an affected version.