Zero Radar
← feed
HighVulnerabilityCVE-2026-115825updated 26 Oct 2026, 02:23 UTC

Perl web server crashes from one oversized request

A single crafted web request can make the Perl server run out of memory and shut down. Until it is restarted, the website or API it powers stays offline.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesPlack / HTTP::Server::PSGI 1.0056 or later · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestDeclares a huge Content-Length header
  2. 2Server receives requestOnly a few body bytes arrive
  3. 3Buffer allocated earlyMemory sized to declared length
  4. 4Out-of-memory crashSingle process exits, no other requests served
  5. ResultServer goes down until restarted

What happened

HTTP::Server::PSGI (Perl, Plack distribution) allocates a read buffer sized to the client's declared Content-Length before receiving the body, so a large declared length causes an out-of-memory crash.

Why it is dangerous: Any remote user who can reach the server can take it down with one request, causing a denial of service for everyone relying on that service.

Are you affected?

You are affected if you run HTTP::Server::PSGI from the Plack distribution before version 1.0056 for Perl and it is reachable by untrusted clients.

Plack / HTTP::Server::PSGI versions before 1.0056

What to do

  1. Update the Plack distribution (HTTP::Server::PSGI) to version 1.0056 or later
  2. Restart the server after updating so the fixed code is loaded
  3. If you cannot update right away, place the server behind a reverse proxy that limits request body size

Timeline

  1. 25 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 00:27 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 00:31 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 02:23 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115825
EPSS
0.3% chance of exploitation within 30 days
Disclosed
25 Oct 2026, 17:17 UTC
On Zero Radar
26 Oct 2026, 00:31 UTC (7 h after disclosure)
Last change
26 Oct 2026, 02:23 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Perl web server crashes from one oversized request · Zero Radar