Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Starman 之前 0.4019 的 Perl 版本會為 HEAD 請求發送響應本文，使保持連線上的響應不同步。對於 HEAD 要求，Starman 會省略區塊框架，但仍會在陣列和串流回應路徑上寫入應用程式傳回的內文。狀態為 1xx、204 或 304 的回應也帶有正文。在保持連線或管線連線上，用戶端會讀取這些位元組作為下一個回應的開頭。重複使用上游連線的前端 Proxy 可能會將回應與錯誤的要求配對。（CVE-2026-115823）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 之前的 Starman 版本 0.4019 会针对 Perl 发送 HEAD 请求的响应正文，使持续连接上的响应去同步化。对于 HEAD 请求，Starman 将省略分块帧，但仍会在数组和流式响应路径上写入应用程序返回的正文。状态为 1xx、204 或 304 的响应也带有正文。在保持活动或管道连接上，客户端将这些字节作为下一个响应的开头进行读取。重用上游连接的前端代理随后可能将响应与错误的请求配对。（CVE-2026-115823）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Perl 用の 0.4019 より前の Starman のバージョンは、HEAD リクエストに対して応答本文を送信し、キープアライブ接続で応答を非同期化します。HEAD リクエストに対して、Starman はチャンクフレーミングを省略しますが、それでもアプリケーションから返された本文を配列パスとストリーミング応答パスの両方で書き込みます。1xx、204、または304ステータスの応答もボディを運びます。キープアライブまたはパイプライン接続では、クライアントは次の応答の開始としてこれらのバイトを読み取ります。上流接続を再利用するフロントエンドプロキシは、応答を間違ったリクエストとペアにする可能性があります。(CVE-2026-115823)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、d8b29eb8-d2d8-11f1-97dc-40b034429ecf のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    Starman プロジェクトによる報告:
    [セキュリティ]

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a2df1dfb37 advisory.

    Starman 0.4019 fixes several CVEs:
    Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory     (CVE-2026-115824)     Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400     (CVE-2026-115822)     Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and     streaming paths (CVE-2026-115823)     Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to     each wait for more of the body, and the new --body-timeout option limits the total time (default 300     seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817)     Reject Transfer-Encoding other than chunked (400/501) and close the connection after a request with both     Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c02d051eaf advisory.

    Starman 0.4019 fixes several CVEs:
    Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory     (CVE-2026-115824)     Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400     (CVE-2026-115822)     Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and     streaming paths (CVE-2026-115823)     Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to     each wait for more of the body, and the new --body-timeout option limits the total time (default 300     seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817)     Reject Transfer-Encoding other than chunked (400/501) and close the connection after a request with both     Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses     on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body     returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or     304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as     the start of the next response. A front-end proxy that reuses upstream connections may then pair responses     with the wrong requests. (CVE-2026-115823)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d8b29eb8-d2d8-11f1-97dc-40b034429ecf advisory.

    Starman project reports:
    [SECURITY]

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2106e35a84 advisory.

    Starman 0.4019 fixes several CVEs:
    Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory     (CVE-2026-115824)     Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400     (CVE-2026-115822)     Do not send a response body for HEAD requests or 1xx, 204 and 304 responses, on both the array and     streaming paths (CVE-2026-115823)     Limit how long a request body may take to arrive: --read-timeout (default 5 seconds) now also applies to     each wait for more of the body, and the new --body-timeout option limits the total time (default 300     seconds; raise it or set it to 0 for slower uploads). Expiry gets 408 (CVE-2026-115817)     Reject Transfer-Encoding other than chunked (400/501) and close the connection after a request with both     Transfer-Encoding and Content-Length. Completes the fix for CVE-2026-40560


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
371975	Linux Distros 未修補弱點：CVE-2026-115823	Nessus	Misc.	10/26/2026	11/3/2026	critical
371975	Linux Distros 未修补的漏洞：CVE-2026-115823	Nessus	Misc.	10/26/2026	11/3/2026	critical
371975	Linux Distros のパッチ未適用の脆弱性: CVE-2026-115823	Nessus	Misc.	10/26/2026	11/3/2026	critical
373485	FreeBSD:p5-Starman -- 複数の脆弱性(d8b29eb8-d2d8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	10/29/2026	11/3/2026	critical
376830	Fedora 43 : perl-Starman (2026-a2df1dfb37)	Nessus	Fedora Local Security Checks	11/6/2026	11/6/2026	critical
376842	Fedora 45 : perl-Starman (2026-c02d051eaf)	Nessus	Fedora Local Security Checks	11/6/2026	11/6/2026	critical
371975	Linux Distros Unpatched Vulnerability : CVE-2026-115823	Nessus	Misc.	10/26/2026	11/3/2026	critical
373485	FreeBSD : p5-Starman -- multiple vulnerabilities (d8b29eb8-d2d8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	10/29/2026	11/3/2026	critical
376828	Fedora 44 : perl-Starman (2026-2106e35a84)	Nessus	Fedora Local Security Checks	11/6/2026	11/6/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical