/ 
Plack-1.0055
⭐ Starred 488 / Plack::App::WrapCGI
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::App::WrapCGI - Compiles a CGI script as PSGI application

SYNOPSIS

use Plack::App::WrapCGI;

my $app = Plack::App::WrapCGI->new(script => "/path/to/script.pl")->to_app;

# if you want to execute as a real CGI script
my $app = Plack::App::WrapCGI->new(script => "/path/to/script.rb", execute => 1)->to_app;

DESCRIPTION

Plack::App::WrapCGI compiles a CGI script into a PSGI application using CGI::Compile and CGI::Emulate::PSGI, and runs it with any PSGI server as a PSGI application.

See also Plack::App::CGIBin if you have a directory that contains a lot of CGI scripts and serve them like Apache's mod_cgi.

METHODS

new
my $app = Plack::App::WrapCGI->new(%args);

Creates a new PSGI application using the given script. %args has two parameters:

script

The path to a CGI-style program. This is a required parameter.

execute

An optional parameter. When set to a true value, this app will run the script with a CGI-style fork/exec model. Note that you may run programs written in other languages with this approach.

AUTHOR

Tatsuhiko Miyagawa

SEE ALSO

Plack::App::CGIBin