Fedora Security Advisories

Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

perl-Starman-0.4019-1.fc45

2 hours 25 minutes ago

FEDORA-2026-c02d051eaf Packages in this update:

perl-Starman-0.4019-1.fc45

Update description:

Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

perl-Starman-0.4019-1.fc44

Fedora Security Advisories

2 hours 25 minutes ago

FEDORA-2026-2106e35a84 Packages in this update:

perl-Starman-0.4019-1.fc44

Update description:

Starman 0.4019 fixes several CVEs: Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory (CVE-2026-115824) Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 (CVE-2026-115822) Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and streaming paths (CVE-2026-115823) Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to each wait for more of the body, and the new --body-timeout option limits the total time (default 300 seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817) Reject Transfer-Encoding other than "chunked" (400/501) and close the connection after a request with both Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

perl-HTTP-Headers-ActionPack-0.10-1.fc43

Fedora Security Advisories

2 hours 43 minutes ago

FEDORA-2026-5ca1419368 Packages in this update:

perl-HTTP-Headers-ActionPack-0.10-1.fc43

Update description:

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.

perl-HTTP-Headers-ActionPack-0.10-1.fc45

Fedora Security Advisories

2 hours 43 minutes ago

FEDORA-2026-37e6cc76fc Packages in this update:

perl-HTTP-Headers-ActionPack-0.10-1.fc45

Update description:

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.

perl-HTTP-Headers-ActionPack-0.10-1.fc44

Fedora Security Advisories

2 hours 43 minutes ago

FEDORA-2026-e94650c1ee Packages in this update:

perl-HTTP-Headers-ActionPack-0.10-1.fc44

Update description:

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. Version 0.10 uses substrings, not regexes to prevent this from happening.