Back Linuxsecurity

Arch Linux 2026 perl-HTTPD

Linuxsecurity •LinuxSecurity Advisories • May 8, 2026

Starman is a PSGI perl web server that has unique features such as high performance, preforking, use of signals and a small memory footprint. It is PSGI compatible and offers HTTP/1.1 support. Update Information : Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy. This package updates Starman to 0.4018 where Transfer-Encoding now takes precedence over Content-Length.

Starman is a PSGI perl web server that has unique features such as high

performance, preforking, use of signals and a small memory footprint. It is PSGI

compatible and offers HTTP/1.1 support.

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy. This package updates Starman to 0.4018 where Transfer-Encoding now takes precedence over Content-Length.

* Wed Apr 29 2026 Emmanuel Seyman - 0.4018-1 - Update to 0.4018 (which contains a fix for CVE-2026-40560)

[ 1 ] Bug #2463491 - perl-Starman-0.4018 is available [ 2 ] Bug #2463795 - CVE-2026-40560 perl-Starman: Starman: HTTP Request Smuggling via improper header precedence [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b94aad33a5' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical HTTP Request Smuggling Vulnerability in Starman Web Server A critical vulnerability has been identified in Starman versions prior to 0.4018, allowing HTTP Request Smuggling due to improper header precedence. The issue arises when both 'Content-Length' and 'Transfer-Encoding: chunked' headers are present, with Starman incorrectly prioritizing 'Content-Length'. This flaw, documented as CVE-2026-40560, could enable attackers to smuggle malicious HTTP requests through a front-end reverse proxy. The vulnerability affects various Linux distributions, including Fedora and Mageia, prompting urgent updates. The fix has been implemented in Starman version 0.4018, released on April 29, 2026. Users are advised to update their systems immediately to mitigate the risk of exploitation. The vulnerability was published on April 28, 2026, and poses a significant threat to web applications relying on this server. 4 sources 73

Extracted Entities

CVEs (1)

CVE-2026-40560

Vulnerabilities (1)

HTTP Request Smuggling Via Improper Header Precedence