/ 
Plack-1.0055
⭐ Starred 488 / Plack::Handler::HTTP::Server::PSGI
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Handler::HTTP::Server::PSGI - adapter for HTTP::Server::PSGI

SYNOPSIS

% plackup -s HTTP::Server::PSGI \
    --host 127.0.0.1 --port 9091 --timeout 120

BACKWARD COMPATIBLITY

Since Plack 0.99_22 this handler doesn't support preforking configuration i.e. --max-workers. Use Starman or Starlet if you need preforking PSGI web server.

CONFIGURATIONS

host

Host the server binds to. Defaults to all interfaces.

port

Port number the server listens on. Defaults to 8080.

timeout

Number of seconds a request times out. Defaults to 300.

max-reqs-per-child

Number of requests per worker to process. Defaults to 100.

AUTHOR

Kazuho Oku

Tatsuhiko Miyagawa

SEE ALSO

Plack HTTP::Server::PSGI