/ 
Plack-1.0055
⭐ Starred 488 / Plack::Middleware::AccessLog::Timed
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::AccessLog::Timed - Logs requests with time and accurate body size

SYNOPSIS

# in app.psgi
use Plack::Builder;

builder {
    enable "Plack::Middleware::AccessLog::Timed",
        format => "%v %h %l %u %t \"%r\" %>s %b %D";
    $app;
};

DESCRIPTION

Plack::Middleware::AccessLog::Timed is a subclass of Plack::Middleware::AccessLog but uses a wrapped body handle to get the actual response body size %b (even if it's not a chunk of array or a real filehandle) and the time taken to serve the request: %T or %D.

This wraps the response body output stream to capture the time taken for the PSGI server to read the whole response body.

This would mean, if the middleware is in use, it will prevent some server-side optimizations like sendfile(2) from working, as well as middleware like Plack::Middleware::ContentLength can't guess the body size out of the file handle.

If all you want is to capture the time taken in your PSGI application and do not want the wrapped body behavior described above, consider instead applying Plack::Middleware::Runtime and using Plack::Middleware::AccessLog to log the X-Runtime header.

CONFIGURATION

Same as Plack::Middleware::AccessLog.

AUTHOR

Tatsuhiko Miyagawa

SEE ALSO

Plack::Middleware::AccessLog

Plack::Middleware::Runtime