Starman, a Perl HTTP server, mistakenly includes body data in responses to HEAD requests for all pre‑0.4019 releases. This violates the HTTP specification, which requires HEAD responses to be empty apart from headers. Because the server omits chunked framing and still writes the body, clients receive stray bytes that are interpreted as the start of an unread response. This desynchronization can expose unintended data, confuse client logic, and trigger failures when a connection is reused or pipelined.

All deployments of Starman for Perl running a version earlier than 0.4019 are affected. Users of newer releases are not vulnerable. The only vendor information is the Starman project maintained by Marek I. Y. Kawara.

The vulnerability is network‑based and can be triggered by normal HEAD requests sent over a keep‑alive or pipelined TCP connection. Attackers can craft requests that force the server to emit a body, causing a client or upstream proxy to misinterpret subsequent data. The CVSS score and EPSS are not provided, and the vulnerability is not listed in the CISA KEV catalog. No severity metrics are available to quantify the risk, but the described behaviour could lead to confusion in client logic and data leakage when connections are reused.