Denial of Service Vulnerability in HTTP::Server::PSGI by Perl
CVE-2026-115825

Currently unrated

Key Information:

Status
Vendor
CVE Published:
25 October 2026

What is CVE-2026-115825?

A vulnerability in HTTP::Server::PSGI permits a remote attacker to crash the server by sending a request that specifies an excessively large Content-Length header. As the server prepares to handle the incoming request, it attempts to allocate memory based on the declared size before any data is received. This can lead to an out-of-memory error, causing the server to terminate, and as HTTP::Server::PSGI operates as a single process, it will remain down until manually restarted. This issue underscores the importance of input validation and handling in web server implementations.

References

https://github.com/plack/Plack/commit/11545871cadc5df1b74...
patch
https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.