CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

[Robert Rothenberg <rrwo () cpansec org>]

========================================================================
CVE-2026-115825                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-115825

  Distribution:  Plack
      Versions:  before 1.0056
      MetaCPAN:  https://metacpan.org/dist/Plack
      VCS Repo:  https://github.com/plack/Plack


HTTP::Server::PSGI versions before 1.0056 for Perl allow a single
request to crash the server by declaring a large Content-Length

Description
-----------
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single
request to crash the server by declaring a large Content-Length.

The request body is read with sysread() calls sized by the remaining
Content-Length. Perl grows the read buffer to the requested length
before any data arrives, so the server tries to allocate as much memory
as the client declares.

A remote attacker can send one request with a large Content-Length and
a few body bytes, and perl exits with an out-of-memory error before the
application is called. HTTP::Server::PSGI runs as a single process, so
the server stays down until restarted.

Problem types
-------------
- CWE-789 Memory Allocation with Excessive Size Value

Solutions
---------
Upgrade to Plack 1.0057 or later.

References
----------
https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch
https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes