CVE-2026-40561: Starlet HTTP Request Smuggling Vulnerability

CVE-2026-40561 Overview

CVE-2026-40561 is an HTTP Request Smuggling vulnerability in Kazuho Starlet, a Perl-based HTTP server, affecting versions through 0.31. The flaw stems from incorrect header precedence handling. Starlet prioritizes the Content-Length header over Transfer-Encoding: chunked when both are present in an inbound HTTP request. RFC 7230 Section 3.3.3 mandates the opposite behavior, requiring Transfer-Encoding to take precedence. An attacker can exploit this discrepancy to smuggle malicious HTTP requests through a front-end reverse proxy that correctly honors Transfer-Encoding. Successful exploitation can bypass front-end security controls, poison shared caches, or hijack other users' requests. The weakness is classified as [CWE-444] Inconsistent Interpretation of HTTP Requests.

Critical Impact
An attacker positioned behind a reverse proxy can smuggle crafted requests to bypass security filters, poison caches, and access unauthorized backend resources.

Affected Products

Kazuho Starlet for Perl, all versions through 0.31
Deployments where Starlet sits behind a front-end reverse proxy that honors Transfer-Encoding: chunked
Perl web applications using Starlet as the PSGI HTTP backend

Discovery Timeline

2026-05-03 - CVE-2026-40561 published to NVD
2026-05-03 - Public disclosure via Openwall OSS-Security
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-40561

Vulnerability Analysis

HTTP Request Smuggling occurs when intermediaries and backends disagree on where one HTTP request ends and the next begins. RFC 7230 Section 3.3.3 specifies that when both Content-Length and Transfer-Encoding headers appear in the same request, Transfer-Encoding: chunked must take precedence and Content-Length must be ignored. Starlet inverts this logic, parsing the body length from Content-Length even when Transfer-Encoding: chunked is present. A reverse proxy that complies with the RFC will frame the request using chunked encoding, while Starlet frames the same byte stream using the declared Content-Length. The mismatch lets an attacker append a hidden second request that the backend treats as new traffic.

Root Cause

The defect lies in Starlet's request header parser, which evaluates Content-Length before checking for Transfer-Encoding. When both headers are accepted simultaneously without rejection or normalization, the framing decision desynchronizes from any standards-compliant front-end. The upstream fix is published as commit a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0, which adjusts header precedence to align with RFC 7230.

Attack Vector

The attack requires a front-end reverse proxy or load balancer in front of Starlet. The attacker sends a single TCP connection request containing both Content-Length and Transfer-Encoding: chunked headers along with a crafted body. The proxy forwards the request using chunked framing, but Starlet reads only the bytes specified by Content-Length and treats the remaining bytes as the start of the next request on the keep-alive connection. The smuggled request can target administrative endpoints, hijack the next legitimate user's session, or poison upstream caches. Exploitation does not require authentication or user interaction. See the Openwall OSS-Security Post and IETF RFC 7230 Section 3.3.3 for protocol-level detail.

Detection Methods for CVE-2026-40561

Indicators of Compromise

HTTP requests arriving at Starlet that contain both Content-Length and Transfer-Encoding: chunked headers in the same message.
Unexpected method, path, or Host header values appearing in access logs immediately after a chunked request from a different client.
Reverse proxy and backend access logs showing request count or byte count mismatches across the same upstream connection.
Cache poisoning artifacts where unauthenticated users receive responses intended for other sessions.

Detection Strategies

Inspect HTTP traffic at the proxy layer for requests carrying conflicting framing headers and alert on any occurrence.
Correlate proxy and Starlet access logs by connection identifier to surface request boundary desynchronization.
Run periodic synthetic probes that send dual-header requests and verify the backend rejects them rather than processing both.
Use web application firewall rules that reject any request containing both Transfer-Encoding and Content-Length.

Monitoring Recommendations

Forward Starlet, proxy, and WAF logs into a centralized analytics platform and pivot on anomalous request sequences per TCP connection.
Track the version of Starlet deployed across hosts and alert when versions at or below 0.31 appear in production.
Monitor for spikes in 400-class responses from the proxy that may indicate smuggling probes.

How to Mitigate CVE-2026-40561

Immediate Actions Required

Apply the upstream patch from commit a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0 and upgrade Starlet to a version newer than 0.31.
Configure the front-end reverse proxy to reject any request that contains both Content-Length and Transfer-Encoding headers.
Audit access and proxy logs for prior dual-header requests to determine whether smuggling attempts have already occurred.
Disable HTTP keep-alive between the proxy and Starlet as a temporary measure if patching cannot occur immediately.

Patch Information

The vendor has released a fix in the upstream Starlet repository. The corrective change is published as the GitHub Commit Patch and adjusts header precedence so that Transfer-Encoding: chunked is honored when both framing headers are present, restoring compliance with RFC 7230 Section 3.3.3. Operators should rebuild and redeploy any Perl applications that bundle Starlet through cpanm or cpan after the patched release becomes available.

Workarounds

Deploy a WAF rule or proxy directive that drops requests containing both Content-Length and Transfer-Encoding headers.
Terminate HTTP/1.1 keep-alive between the proxy and Starlet so that smuggled bytes cannot reach a second request boundary.
Place a normalizing proxy such as nginx or haproxy in strict mode in front of Starlet to enforce single-framing semantics.

bash

# Example nginx directive to reject conflicting framing headers
map "$http_content_length:$http_transfer_encoding" $smuggle_attempt {
    default 0;
    "~.+:.+"  1;
}

server {
    listen 443 ssl;
    server_name app.example.com;

    if ($smuggle_attempt) {
        return 400;
    }

    location / {
        proxy_pass http://starlet_backend;
        proxy_http_version 1.1;
        # Disable keep-alive to backend until Starlet is patched
        proxy_set_header Connection "close";
    }
}