Starman versions before 0.4019 use a regular expression to parse HTTP chunked request bodies. The pattern does not match lines that contain a bare line feed, causing the matching engine to backtrack quadratically with the length of the hex run. An attacker can exploit this by sending crafted chunked requests that trigger the backtracking, thereby exhausting the CPU of a worker process and denying service to legitimate traffic.

Any installation of the Starman Perl web server that is running a version earlier than 0.4019 is affected. The vulnerability impacts every route exposed by the server because the regex is applied before the application logic is reached.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation reports yet. Nonetheless, the potential for unbounded CPU consumption represents a high impact if applied. Remote attackers can trigger the issue by sending malformed chunked requests without any authentication, making the attack trivial to launch over an open HTTP port. Given the lack of mitigation in older versions, the likelihood of exploitation remains high until an update is applied.