Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-03 | 4 | Disclosure3General1 |
| 2026-05-04 | 1 | Disclosure1 |
Perl CPAN CVE-2026-40561: Starlet versions through 0.31 allows HTTP Request Smuggling via Improper Header Precedence https://www.openwall.com/lists/oss-security/2026/05/03/1
Post summary
A new vulnerability (CVE‑2026‑40561) has been disclosed for Starlet versions up to 0.31, allowing HTTP request smuggling through improper header precedence.
CVE-2026-40561 Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-… https://www.cve.org/CVERecord?id=CVE-2026-40561
Post summary
The text announces CVE-2026-40561, detailing that Starlet (Perl versions ≤0.31) is vulnerable to HTTP Request Smuggling due to improper header precedence between Content-Length and Transfer‑… . No PoC, exploitation, patch, or debunking information is provided.
⚡ New CVE Alert: CVE-2026-40561 🚨 Risk Level: Unknown 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-40561 #CVE-2026-40561 #CVE #CyberSecurity #InfoSec https://t.co/5HwOErgIMM
Post summary
A new CVE-2026-40561 is announced with unknown risk level, impacting multiple unspecified products, and only a link to its NVD entry is provided.
🚨*CVE* CVE-2026-40561 Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-… https://www.cve.org/CVERecord?id=CVE-2026-40561 ----- Traducción: CVE-2026-40561 Sta… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑40561, describing its HTTP Request Smuggling flaw, but offers no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-40561 HTTP Request Smuggling in Starlet Perl Through 0.31 via Header Precedence https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40561
Post summary
CVE-2026-40561 is disclosed as an HTTP Request Smuggling flaw in Starlet Perl through 0.31, caused by header precedence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kazuho | starlet | - | perl | - |