Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Handler - Connects PSGI applications and Web servers

SYNOPSIS

package Plack::Handler::AwesomeWebServer;
sub new {
    my($class, %opt) = @_;
    ...
    return $self;
}

sub run {
    my($self, $app) = @_;
    # launch the AwesomeWebServer and run $app in the loop
}

# then from command line
plackup -s AwesomeWebServer -a app.psgi

DESCRIPTION

Plack::Handler defines an adapter (connector) interface to adapt plackup and Plack::Runner to various PSGI web servers, such as Apache2 for mod_perl and Standalone for HTTP::Server::PSGI.

It is an empty class, and as long as they implement the methods defined as an Server adapter interface, they do not need to inherit Plack::Handler.

If you write a new handler for existing web servers, I recommend you to include the full name of the server module after Plack::Handler prefix, like Plack::Handler::Net::Server::Coro if you write a handler for Net::Server::Coro. That way you'll be using plackup command line option like:

plackup -s Net::Server::Coro

that makes it easy to figure out which web server you're going to use.

METHODS

new
$server = FooBarServer->new(%args);

Creates a new adapter object. %args can take arbitrary parameters to configure server environments but common parameters are:

port

Port number the server listens to.

host

Address the server listens to. Set to undef to listen any interface.

run
$server->run($app);

Starts the server process and when a request comes in, run the PSGI application passed in $app in the loop.

register_service
$server->register_service($app);

Optional interface if your server should run in parallel with other event loop, particularly AnyEvent. This is the same as run but doesn't run the main loop.

SEE ALSO

rackup