Posted by Robert Rothenberg on Oct 30 CVE-2026-115865 Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next...
Starlet versions before 0.33 for Perl (4 CVEs)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/449
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
Posted by Abhinav Agarwal on Oct 30 Hi, I reported the findings behind CVE-2026-102508 and CVE-2026-102509 [1][2]. This follow-up gives the mechanisms and triggers for…
The GNU C Library security advisories update for 2026-10-30
Posted by Adhemerval Zanella Netto on Oct 30 The following security advisories have been published: GLIBC-SA-2026-0025: gettext: Directory traversal via the LANGUAGE…
CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
Posted by Yash Mayya on Oct 30 Severity: moderate Affected versions: - Apache Pinot 0.7.0 before 1.6.0 Description: Incorrect Authorization vulnerability in the…
CallBackery versions before 0.62.0 for Perl (10 CVEs)
Posted by Robert Rothenberg on Oct 30 CVE-2026-13576 CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes CVE-2026-118986…
Business::GoCardless versions before 1.01 for Perl (3 CVEs)
Posted by Robert Rothenberg on Oct 30 CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads…
Drupal security advisory (AV26-1105)
Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to…