# CVE-2026-115825: libplack-perl: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Co...

CVE-2026-115825 is fixed in 6 products on 1 platform, first by DEBIAN-CVE-2026-115825, released October 30, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-115825
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0066
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 25, 2026

## Description

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.  The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.  A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libplack-perl Debian 14 | 1.0057-1 | [DEBIAN-CVE-2026-115825](https://patchblox.com/security/data/fix/linux/debian-cve-2026-115825.md) | Oct 30, 2026 |
| Linux | perl-Plack Fedora 43 | 1.0057-1.fc43 | [FEDORA-2026-A2BCAF6C4D](https://patchblox.com/security/data/fix/linux/fedora-2026-a2bcaf6c4d.md) | Nov 7, 2026 |
| Linux | perl-Plack-Handler-Apache2 Fedora 43 | 1.0057-1.fc43 | [FEDORA-2026-A2BCAF6C4D](https://patchblox.com/security/data/fix/linux/fedora-2026-a2bcaf6c4d.md) | Nov 7, 2026 |
| Linux | perl-Plack-Handler-FCGI Fedora 43 | 1.0057-1.fc43 | [FEDORA-2026-A2BCAF6C4D](https://patchblox.com/security/data/fix/linux/fedora-2026-a2bcaf6c4d.md) | Nov 7, 2026 |
| Linux | perl-Plack-Middleware-Log4perl Fedora 43 | 1.0057-1.fc43 | [FEDORA-2026-A2BCAF6C4D](https://patchblox.com/security/data/fix/linux/fedora-2026-a2bcaf6c4d.md) | Nov 7, 2026 |
| Linux | perl-Plack-Test Fedora 43 | 1.0057-1.fc43 | [FEDORA-2026-A2BCAF6C4D](https://patchblox.com/security/data/fix/linux/fedora-2026-a2bcaf6c4d.md) | Nov 7, 2026 |

---

Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.