Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^(([0-9a-fA-F]+).*\015\012)//. A line of hex digits followed by a bare LF and then CRLF never matches, because . does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.