Back Linuxsecurity

Mageia 9 perl-Starman Important HTTP Request Smuggling MGASA-2026

Linuxsecurity •LinuxSecurity Advisories • May 7, 2026

Description: Starman versions before 0.4018 for Perl allow HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

- - - - -

MGASA-2026-0119 - Updated perl-Starman packages fix security vulnerability

- 9/core/perl-Starman-0.401.800-1.mga9

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical HTTP Request Smuggling Vulnerability in Starman Web Server A critical vulnerability has been identified in Starman versions prior to 0.4018, allowing HTTP Request Smuggling due to improper header precedence. The issue arises when both 'Content-Length' and 'Transfer-Encoding: chunked' headers are present, with Starman incorrectly prioritizing 'Content-Length'. This flaw, documented as CVE-2026-40560, could enable attackers to smuggle malicious HTTP requests through a front-end reverse proxy. The vulnerability affects various Linux distributions, including Fedora and Mageia, prompting urgent updates. The fix has been implemented in Starman version 0.4018, released on April 29, 2026. Users are advised to update their systems immediately to mitigate the risk of exploitation. The vulnerability was published on April 28, 2026, and poses a significant threat to web applications relying on this server. 4 sources 73

Extracted Entities

Mageia 9 perl-Starman Important HTTP Request Smuggling MGASA-2026

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (2)

Vulnerabilities (2)