/ 
Plack-1.0055
⭐ Starred 488 / Plack::MIME
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::MIME - MIME type registry

SYNOPSIS

use Plack::MIME;

my $mime = Plack::MIME->mime_type(".png"); # image/png

# register new type(s)
Plack::MIME->add_type(".foo" => "application/x-foo");

# Use MIME::Types as a fallback
use MIME::Types 'by_suffix';
Plack::MIME->set_fallback(sub { (by_suffix $_[0])[0] });

DESCRIPTION

Plack::MIME is a simple MIME type registry for Plack applications. The selection of MIME types is based on Rack's Rack::Mime module.

SEE ALSO

Rack::Mime MIME::Types