Vulnerability · Published Oct 25, 2026 · Assigned by CPANSec
CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length
High 7.5
In plain English
A high-severity security flaw in Plack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libplack-perl | no fix listed | DEBIAN-CVE-2026-115825 |
| Debian:13 | libplack-perl | no fix listed | DEBIAN-CVE-2026-115825 |
| Debian:14 | libplack-perl | 1.0057-1 | DEBIAN-CVE-2026-115825 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Plack | 0 – before 1.0056 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H