CVE-2026-115825
Received Received - Intake

Denial of Service in HTTP::Server::PSGI

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: CPANSec

Description
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-115825
EUVD
EUVD-2026-109562

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
plack http to 1.0056 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HTTP::Server::PSGI versions before 1.0056 for Perl have a denial-of-service vulnerability. A single request with a large Content-Length header causes the server to attempt allocating memory equal to the declared size before reading any data. This leads to an out-of-memory crash since Perl grows the read buffer to the requested length immediately.

Detection Guidance

Monitor for HTTP::Server::PSGI servers crashing with out-of-memory errors after receiving requests with large Content-Length headers. Check server logs for 'Out of memory!' errors or unexpected restarts.

Impact Analysis

A remote attacker can send one malicious request with a huge Content-Length header and minimal body data. This crashes the server with an out-of-memory error. Since HTTP::Server::PSGI runs as a single process, the server remains down until manually restarted, causing downtime and service disruption.

Mitigation Strategies

Update HTTP::Server::PSGI to version 1.0056 or later. If updating is not possible, implement network-level protections like rate limiting or WAF rules to block requests with abnormally large Content-Length headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart