CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

As cited

Copy frozen at 2026-10-26 13:57 UTC (site build).

vulnerabilities

CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

CVE-2026-115825 affects HTTP::Server::PSGI versions before 1.0056 in the Perl Plack distribution. A single request declaring a large Content-Length header can crash the server. The vulnerability was disclosed by the CPAN Security Group on October 25, 2026.

Why it matters: Operators running vulnerable versions of Plack face denial of service risk from unauthenticated remote requests; upgrading to version 1.0056 or later is required to mitigate the crash condition.

Source published

2026-10-26 00:27 UTC

First seen by Cybersecurity Tracker

2026-10-26 01:03 UTC