HTTP::Server::PSGI before 1.0056 crashes on large Content-Length
Original title: CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length
One request that declares a large Content-Length can crash the PSGI server; 1.0056 is the fixed release.
Robert Rothenberg posted CVE-2026-115825 for HTTP::Server::PSGI, part of Plack. Versions before 1.0056 let a single request crash the server by declaring a large Content-Length. The note points to the Plack distribution on MetaCPAN and GitHub.
- The crash is triggered by one request with a large Content-Length.
- Affected releases are HTTP::Server::PSGI before 1.0056.
- The report was posted to oss-security on October 25.
Impact: A single request can crash the server
| Product | Affected | Fixed in |
|---|---|---|
| Plack HTTP::Server::PSGI | before 1.0056 | 1.0056 |
- 1.Upgrade HTTP::Server::PSGI to 1.0056 or later.
- CVEs
- CVE-2026-115825
- Vendors
- Plack
- Products
- HTTP::Server::PSGI
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115825 | Remote memory-exhaustion crash in HTTP::Server::PSGI before 1.0056 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 25 ======================================================================== https://metacpan. org/dist/Plack https://github. com/plack/Plack...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.