Starman versions earlier than 0.4018 implement HTTP header parsing that prioritizes the Content-Length header over Transfer-Encoding: chunked when both are present. According to RFC 7230, the Transfer-Encoding header must take precedence. Because of this improper precedence, an attacker can craft requests that include both headers and mislead Starman into handling payloads incorrectly. The consequence is that malicious HTTP requests can be smuggled past a front‑end reverse proxy, potentially enabling arbitrary request injection, cross‑site request forgery, or other attacks against downstream services that the proxy forwards the request to.

The affected product is Starman for Perl, maintained by MIYAGAWA. All versions preceding 0.4018 are vulnerable. The remedy is to upgrade to Starman 0.4018 or later.

The exploit requires an attacker to be able to send crafted HTTP requests to a server running the vulnerable Starman behind a reverse proxy that forwards requests. Because this attack vector depends on the presence of the proxy, it is not a generic cross‑platform flaw, but can be highly impactful in environments using Starman for load balancing or reverse proxying. No EPSS score or KEV listing is available, so the current exploitation probability is indeterminate, but the potential impact of request smuggling is high in vulnerable configurations.