CVE-2026-115825

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115825", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T16:47:20.192Z", "datePublished": "2026-10-25T16:51:54.897Z", "dateUpdated": "2026-11-02T16:23:24.866Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Server::PSGI"], "packageName": "Plack", "packageURL": "pkg:cpan/Plack", "programFiles": ["lib/HTTP/Server/PSGI.pm"], "programRoutines": [{"name": "HTTP::Server::PSGI::handle_connection"}], "repo": "https://github.com/plack/Plack", "versions": [{"lessThan": "1.0056", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\n\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:51:54.897Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Plack 1.0057 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/26/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-26T01:23:53.588Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T16:23:18.808905Z", "id": "CVE-2026-115825", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:23:24.866Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/26/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-26T01:23:53.588Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115825", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T16:23:18.808905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:23:15.313Z"}}], "cna": {"title": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/plack/Plack", "modules": ["HTTP::Server::PSGI"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.0056", "versionType": "custom"}], "packageURL": "pkg:cpan/Plack", "packageName": "Plack", "programFiles": ["lib/HTTP/Server/PSGI.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Server::PSGI::handle_connection"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Plack 1.0057 or later."}], "references": [{"url": "https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\n\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-25T16:51:54.897Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115825", "state": "PUBLISHED", "dateUpdated": "2026-11-02T16:23:24.866Z", "dateReserved": "2026-10-23T16:47:20.192Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-25T16:51:54.897Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Server::PSGI"], "packageName": "Plack", "packageURL": "pkg:cpan/Plack", "programFiles": ["lib/HTTP/Server/PSGI.pm"], "programRoutines": [{"name": "HTTP::Server::PSGI::handle_connection"}], "repo": "https://github.com/plack/Plack", "versions": [{"lessThan": "1.0056", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\n\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted."}], "id": "CVE-2026-115825", "lastModified": "2026-11-02T17:17:36.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115825", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T16:23:18.808905Z", "version": "2.0.3"}}]}, "published": "2026-10-25T17:17:01.990", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/26/10"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-Plack: perl-Plack: Denial of Service via large Content-Length header", "id": "2560479", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560479"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.", "A flaw was found in perl-Plack. The HTTP::Server::PSGI server pre-allocates memory for incoming request bodies based entirely on the declared Content-Length header before reading data. A remote attacker can exploit this flaw by sending an HTTP request with an excessively large Content-Length header, causing the server to exhaust memory and crash. This results in a Denial of Service (DoS), keeping the single-process server unavailable until it is restarted."], "mitigation": {"lang": "en:us", "value": "Upgrade to perl-Plack 1.0056 or later. As a workaround, do not expose the standalone HTTP::Server::PSGI (a development/reference server) to untrusted networks; front it with a reverse proxy that limits request body size, or use a production handler such as FCGI or Starman."}, "name": "CVE-2026-115825", "public_date": "2026-10-25T16:51:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115825\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115825\nhttps://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch\nhttps://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes"], "statement": "A flaw was found in the Plack Perl web application framework's standalone HTTP::Server::PSGI server. It pre-allocates memory for a request body based on the untrusted Content-Length header before reading data, so a single request with an excessively large Content-Length can cause an out-of-memory exit, leaving the single-process server unavailable until restarted. Upstream fixed this in Plack 1.0056 by capping body reads at 64 KiB.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0056)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http::server::psgi", "vendor": "perl"}], "created": "2026-10-25T21:45:06.769712+00:00", "updated": "2026-11-03T16:37:46.242187+00:00", "vendors": ["perl", "perl$PRODUCT$http::server::psgi"]}