Starlet versions 0.20 through 0.32 for Perl contain a flaw in the routine that decodes chunked request bodies. The routine relies on a regular expression that backtracks linearly with the length of hexadecimal run‑size fields, causing the evaluation time to grow quadratically. An attacker can send a specially crafted chunk‑size line that triggers extreme backtracking, exhausting CPU resources before the application logic is executed.

All installations of Starlet Perl module version 0.20 up to but not including 0.33 are affected. The vulnerability manifests only when Chunked Transfer Encoding is used in HTTP requests, so any web application or proxy that loads the Starlet Perl module could be impacted.

The flaw can be triggered remotely via an HTTP request, making it a remote denial‑of‑service weakness. The attacker only needs to send an oversized chunk‑size line – a 128 KiB request can consume around one minute of CPU time on a single worker. Since no public exploits exist yet, the EPSS score is unavailable and the vulnerability is not listed in CISA KEV. The lack of an exploit cap and the ability to affect any service that uses the vulnerable module mean the risk is significant for exposed services, especially those that do not impose strict request size limits or enforce timeouts.