Starlet versions before 0.33 expose a flaw where a request that declares a large Content‑Length header forces the Perl runtime to pre‑allocate a buffer equal to that length. If the declared length exceeds available memory, the worker process dies with an uncaught out‑of‑memory exception before any application code runs, resulting in a service restart. The vulnerability can be triggered with a very small request body; the attacker simply repeats the exploit to cause repeated worker restarts.

This issue affects the Starlet Perl module in all releases older than 0.33. Systems running code that imports Starlet for HTTP server capabilities and that accept externally supplied Content‑Length headers are potentially impacted. The specific versions are any Starlet version earlier than 0.33.

The flaw is exploitable over the network, requiring no special privileges and allowing an attacker to cause a denial of service simply by sending specially crafted HTTP requests. CVSS and EPSS metrics are not available, and the vulnerability is not listed in the CISA KEV catalog, but the consequence is a forced restart of worker processes which can incapacitate the entire application or service until the workers recover. The attack vector is remote over HTTP and can be performed repeatedly, leading to sustained availability loss.