Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::AccessLog - Logs requests like Apache's log format

SYNOPSIS

# in app.psgi
use Plack::Builder;

builder {
    enable "Plack::Middleware::AccessLog", format => "combined";
    $app;
};

DESCRIPTION

Plack::Middleware::AccessLog forwards the request to the given app and logs request and response details to the logger callback. The format can be specified using Apache-like format strings (or combined or common for the default formats). If none is specified combined is used.

This middleware uses calculable Content-Length by checking body type, and cannot log the time taken to serve requests. It also logs the request before the response is actually sent to the client. Use Plack::Middleware::AccessLog::Timed if you want to log details after the response is transmitted (more like a real web server) to the client.

This middleware is enabled by default when you run plackup as a default development environment.

CONFIGURATION

format
enable "Plack::Middleware::AccessLog",
    format => '%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i"';

Takes a format string (or a preset template combined or custom) to specify the log format. This middleware uses Apache::LogFormat::Compiler to generate access_log lines. See more details on perldoc Apache::LogFormat::Compiler

%%    a percent sign
%h    REMOTE_ADDR from the PSGI environment, or -
%l    remote logname not implemented (currently always -)
%u    REMOTE_USER from the PSGI environment, or -
%t    [local timestamp, in default format]
%r    REQUEST_METHOD, REQUEST_URI and SERVER_PROTOCOL from the PSGI environment
%s    the HTTP status code of the response
%b    content length of the response
%T    custom field for handling times in subclasses
%D    custom field for handling sub-second times in subclasses
%v    SERVER_NAME from the PSGI environment, or -
%V    HTTP_HOST or SERVER_NAME from the PSGI environment, or -
%p    SERVER_PORT from the PSGI environment
%P    the worker's process id
%m    REQUEST_METHOD from the PSGI environment
%U    PATH_INFO from the PSGI environment
%q    QUERY_STRING from the PSGI environment
%H    SERVER_PROTOCOL from the PSGI environment

Some of these format fields are only supported by middleware that subclasses AccessLog.

In addition, custom values can be referenced, using %{name}, with one of the mandatory modifier flags i, o or t:

%{variable-name}i    HTTP_VARIABLE_NAME value from the PSGI environment
%{header-name}o      header-name header in the response
%{time-format]t      localtime in the specified strftime format
logger
my $logger = Log::Dispatch->new(...);
enable "Plack::Middleware::AccessLog",
    logger => sub { $logger->log(level => 'debug', message => @_) };

Sets a callback to print log message to. It prints to the psgi.errors output stream by default.

char_handlers
my $handlers = {
    'z' => sub {
        my ($env,$req) = @_;
        return $env->{HTTP_X_FORWARDED_FOR};
    }
};

enable "Plack::Middleware::AccessLog",
    format => '%z %{HTTP_X_FORWARDED_FOR|REMOTE_ADDR}Z',
    char_handlers => $handlers;

Takes a hash reference and passes it to the underlying Apache::LogFormat::Compiler's char_handlers. For more details see "ADD CUSTOM FORMAT STRING" in Apache::LogFormat::Compiler.

block_handlers
my $handlers = {
    'Z' => sub {
        my ($block,$env,$req) = @_;
        # block eq 'HTTP_X_FORWARDED_FOR|REMOTE_ADDR'
        my ($main, $alt) = split('\|', $args);
        return exists $env->{$main} ? $env->{$main} : $env->{$alt};
    }
};

enable "Plack::Middleware::AccessLog",
    format => '%z %{HTTP_X_FORWARDED_FOR|REMOTE_ADDR}Z',
    block_handlers => $handlers;

Takes a hash reference and passes it to the underlying Apache::LogFormat::Compiler's block_handlers. For more details see "ADD CUSTOM FORMAT STRING" in Apache::LogFormat::Compiler.

AUTHORS

Tatsuhiko Miyagawa

Masahiro Nagano

SEE ALSO

Apache::LogFormat::Compiler, http://httpd.apache.org/docs/2.2/mod/mod_log_config.html Rack::CustomLogger