The vulnerability, classified as CWE‑444, occurs in the Starlet Perl library before version 0.33, which erroneously sends a response body for HEAD requests because the request method is not relayed to the response writer. Consequently, when a client issues a HEAD request a payload may be transmitted even though the HTTP specification mandates that a HEAD response must contain no body. In addition, responses with status codes that should have empty bodies (such as 204 or 304) still include data, further exacerbating the problem. If a response uses chunked transfer encoding, the terminating sequence is also transmitted, which can be interpreted by downstream clients as part of the following message. The result is that the next HTTP message on the same TCP connection begins with stray bytes, breaking the protocol parsing state machine of proxies, load balancers or clients that employ persistent or pipelined HTTP/1.1 connections.

Any deployment that uses the Starlet library for Perl versions earlier than 0.33 is affected. This includes web applications that build on the Plack framework, particularly those that employ the Plack::Middleware::Head middleware, as well as any reverse‑proxy or other HTTP components that rely on Starlet’s request handling.

The vulnerability can be triggered by any attacker who can send HTTP requests to the server, making it feasible for malicious actors to exploit the issue over public or internal networks. Because the misbehaviour corrupts subsequent responses on the same connection, it can cause proxy or client misinterpretation, leading to denial of service or occasional data leakage from the body of a HEAD request. Although the EPSS score is currently not available and the issue is not listed in the CISA KEV catalog, its impact on HTTP flow integrity is significant, especially for services that maintain persistent or pipelined connections. The exploit is straightforward: deliver a crafted HEAD request to a vulnerable server and observe the corruption in the following response; the attacker does not need privileged access or prior exploitation of other components.