{"id":"CVE-2026-115825","kind":"vulnerability","aliases":["CVE-2026-115825"],"related":[],"title":"HTTP::Server::PSGI: one oversized Content-Length request crashes the Perl server","description":"HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\n\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.","summary":"HTTP::Server::PSGI reads request bodies with buffers sized by the declared Content-Length before any data arrives. A single request declaring a large length makes Perl run out of memory and exit, taking the server down until restarted.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-server-psgi","package","perl","psgi"],"not_affected_if":["not-using-http-server-psgi"],"how_to_check":"- Run `cpanm --info HTTP::Server::PSGI` or `perl -MHTTP::Server::PSGI -e 'print $HTTP::Server::PSGI::VERSION'` to read the installed version\n- Check the lockfile or cpanfile for the pinned `HTTP::Server::PSGI` version","fix":"- Upgrade HTTP::Server::PSGI to `1.0056` or later\n- Until upgraded, put a reverse proxy in front that caps request body size","status":"open","published_at":"2026-10-25T17:17:01+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","triaged_at":"2026-10-25T17:43:49+00:00","updated_at":"2026-10-25T17:43:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T17:43:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HTTP::Server::PSGI to `1.0056` or later\n- Until upgraded, put a reverse proxy in front that caps request body size","reach":"internet","title":"HTTP::Server::PSGI: one oversized Content-Length request crashes the Perl server","impact":"low","summary":"HTTP::Server::PSGI reads request bodies with buffers sized by the declared Content-Length before any data arrives. A single request declaring a large length makes Perl run out of memory and exit, taking the server down until restarted.","category":"package","nicknames":[],"who_cares":["perl","http-server-psgi","psgi"],"confidence":0.7,"needs_auth":"no","worst_case":"Server process crashes, stays down until manually restarted","analyst_note":"Confirm the affected version range and fixed release against the NVD entry and upstream CPAN changelog; sources give only 'before 1.0056'.","how_to_check":"- Run `cpanm --info HTTP::Server::PSGI` or `perl -MHTTP::Server::PSGI -e 'print $HTTP::Server::PSGI::VERSION'` to read the installed version\n- Check the lockfile or cpanfile for the pinned `HTTP::Server::PSGI` version","needs_analyst":true,"not_affected_if":["not-using-http-server-psgi"],"who_is_affected":"Any Perl application that serves HTTP through HTTP::Server::PSGI, since it runs as a single process and any client that can reach the port can send the request. Deployments behind a proxy that already limits body size are less exposed, but the sources do not say which proxy settings are sufficient. Teams that do not use HTTP::Server::PSGI can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":3405,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115825':16A,19A '-2026':15A,18A '1.0056':72C 'alloc':123C 'allow':75C 'applic':161C 'arriv':45B,117C 'attack':133C 'bodi':32B,92C,147C 'buffer':34B,109C 'byte':148C 'call':97C,163C 'client':129C 'content':7A,40B,88C,103C,142C 'content-length':6A,39B,87C,102C,141C 'crash':10A,80C 'cve':14A,17A 'data':44B,116C 'declar':38B,49B,84C,130C 'error':158C 'exit':60B,151C 'grow':106C 'http':1A,21B,27B,67C,164C 'http-server-psgi':20B 'larg':51B,86C,140C 'length':8A,41B,52B,89C,104C,113C,143C 'make':53B 'memori':58B,126C,157C 'much':125C 'one':4A,136C 'out-of-memori':154C 'overs':5A 'packag':24B 'perl':12A,25B,54B,74C,105C,150C 'process':171C 'psgi':3A,23B,26B,29B,69C,166C 'read':30B,94C,108C 'remain':101C 'remot':132C 'request':9A,31B,48B,78C,91C,112C,137C 'restart':66B,178C 'run':55B,167C 'send':135C 'server':2A,13A,22B,28B,63B,68C,82C,120C,165C,174C 'singl':47B,77C,170C 'size':35B,98C 'stay':175C 'sysread':96C 'take':61B 'tri':121C 'version':70C","nicknames":[],"mitigations":[],"who_affected":"Any Perl application that serves HTTP through HTTP::Server::PSGI, since it runs as a single process and any client that can reach the port can send the request. Deployments behind a proxy that already limits body size are less exposed, but the sources do not say which proxy settings are sufficient. Teams that do not use HTTP::Server::PSGI can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T17:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115825","severity":null,"published_at":"2026-10-25T17:17:01+00:00","modified_at":"2026-10-25T17:17:01+00:00","first_seen_at":"2026-10-25T17:42:01+00:00","fetched_at":"2026-10-25T17:42:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}