Starman versions before 0.4019 contain a flaw in the chunked request decoder that buffers each complete chunk in memory until the chunk and its CRLF are fully received, and the decoder imposes no limit on the length of the chunk-size line. Because of this, a client that reports an extremely large chunk size or sends a chunk-size line that never terminates can cause the server to allocate memory continuously as the data streams in. This unbounded allocation can consume all memory available to a worker process, rendering the application unresponsive and resulting in a denial‑of‑service condition.

The vulnerability affects the Starman Perl application server in all releases earlier than 0.4019. Users running Starman 0.4019 or later are not impacted. The vendor is MIYAGAWA, and the flaw resides in the Starman package’s implementation of HTTP chunked transfer decoding.

A remote attacker can trigger the memory exhaustion with a single TCP connection by sending a malicious chunked request. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires only a single malformed request, the risk of denial of service is significant for systems that expose Starman to external traffic.