Vulnerability feed

Executive summary

HTTP::Server::PSGI for Perl, in versions before 1.0056, can be crashed by a single request that declares a very large Content-Length. The advisory describes this as a denial of service that makes the server run out of memory, and it says a fix caps body reads at 64 KiB. The advisory does not state a CVSS score or an explicit vendor recommendation beyond the fix in the patch.

Technical summary

The flaw is a resource exhaustion (denial of service) issue in HTTP::Server::PSGI, where the whole remaining Content-Length is passed to sysread and Perl grows the buffer to that size before reading, causing an "Out of memory!" failure on Linux. The attack needs only a single crafted HTTP request declaring a large Content-Length; no authentication is mentioned in the advisory. Affected versions are stated as before 1.0056, and the fixed version is stated as 1.0056 by the vendor's description of the affected range. The fix reads the body in chunks of at most 64 KiB, and the added test checks that a huge Content-Length does not produce a sysread larger than MAX_REQUEST_SIZE. No workarounds, CVSS score, exploitation status, or detection guidance is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch

Score

No CVSS score published.

Affects

HTTP::Server::PSGIHTTP::Server::PSGI