The Starlet Perl HTTP framework contains a flaw in its chunked request body decoder. The decoder buffers each read into a single unconsumed input buffer without imposing limits on the length of the chunk‑size line or the data of each chunk. Because the buffer grows as the client continues to send data, an attacker can exhaust a worker process’s memory with a single crafted request. The vulnerability results in a denial of service by draining the process’s heap, potentially bringing the web application or host down without any authentication or privilege escalation.

Affected systems are Starlet releases 0.20 through 0.32 compiled for Perl. Versions 0.33 and later fix the unbounded buffering issue. The vulnerability exists only in the Perl implementation of the HTTP decoder; other Starlet release modes are not impacted.

Risk is moderate to high because the vulnerability can be triggered remotely via HTTP/1.1 without authentication. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a published exploit does not diminish the potential impact. Based on the description, it is inferred that the likely attack vector is remote through HTTP, requiring only that a web server accept chunked request bodies. The attacker can bring a worker process down with a single request, and no privileged access or authentication is needed.