HTTP::Server::PSGI before 1.0056 crashes on large Content-Length
One request that declares a large Content-Length can crash the PSGI server; 1.0056 is the fixed release.
44
CVE-2026-115825
Remote memory-exhaustion crash in HTTP::Server::PSGI before 1.0056
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
HTTP::Server::PSGI for Perl sizes a sysread() buffer from the client-supplied Content-Length before any body data arrives, so Perl tries to allocate as much memory as the header declares. A remote attacker can send one request with a huge Content-Length and a few body bytes; perl exits with an out-of-memory error before the application runs. The server is a single process and stays down until restarted. Versions before 1.0056 are affected.
What to do: Upgrade HTTP::Server::PSGI to 1.0056.
| Product | Affected | Fixed in |
|---|---|---|
| Perl HTTP::Server::PSGI | before 1.0056 | 1.0056 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
- Weakness
- CWE-789