CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called.…

Not reported by tracked sources.

Track

Current priority score and EPSS: loading from the tracker record. They are read when this page loads and are not shown without JavaScript. They change daily and are not part of "Source last updated".

Not reported by tracked sources.

Not reported by tracked sources.

Tracker inference. Guidance from the decision tier: No action now. Remediate within standard update timelines. Monitor for change.