Starman versions before 0.4018 implement header parsing that incorrectly prioritizes the "Content-Length" header over "Transfer-Encoding: chunked" when both are present. According to RFC 7230, the Transfer-Encoding header must take precedence. Because of this improper precedence, an attacker can craft requests containing both headers and mislead Starman into interpreting the payload size incorrectly. This flaw allows an attacker to smuggle malicious HTTP requests through a front‑end reverse proxy. The CVE statement does not specify downstream effects; based on the description, it is inferred that the smuggled requests could interfere with or manipulate downstream services, but these specific actions are not confirmed in the provided data.

The affected product is Starman for Perl, maintained by MIYAGAWA. All versions preceding 0.4018 are vulnerable. The remedy is to upgrade to Starman 0.4018 or later.

The attack requires an attacker to send crafted HTTP requests to a server running the vulnerable Starman behind a reverse proxy that forwards requests. Because this attack vector depends on the presence of the proxy and the inclusion of both headers, it is not a generic cross‑platform flaw. The EPSS score is < 1%, indicating a low likelihood of exploitation, while the CVSS score of 7.5 indicates moderate to high impact. The vulnerability is not listed in KEV.