/ 
Plack-1.0055
⭐ Starred 488 / HTTP::Server::PSGI
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

HTTP::Server::PSGI - Standalone PSGI compatible HTTP server

SYNOPSIS

use HTTP::Server::PSGI;

my $server = HTTP::Server::PSGI->new(
    host => "127.0.0.1",
    port => 9091,
    timeout => 120,
);

$server->run($app);

DESCRIPTION

HTTP::Server::PSGI is a standalone, single-process and PSGI compatible HTTP server implementations.

This server should be great for the development and testing, but might not be suitable for a production use.

Some features in HTTP/1.1, notably chunked requests, responses and pipeline requests are NOT supported, and it also does not support HTTP/0.9.

See Starman or uWSGI server if you want HTTP/1.1 and other features ready for a production use.

PREFORKING

HTTP::Server::PSGI does NOT support preforking. See Starman or Starlet if you want a multi-process prefork web servers.

HARAKIRI SUPPORT

This web server supports `psgix.harakiri` extension defined in the PSGI::Extensions.

This application is a non-forking single process web server (i.e. `psgi.multiprocess` is false), and if your application commits harakiri, the entire web server stops too. In case this behavior is not what you want, be sure to check `psgi.multiprocess` as well to enable harakiri only in the preforking servers such as Starman.

On the other hand, this behavior might be handy if you want to embed this module in your application and serve HTTP requests for only short period of time, then go back to your main program.

AUTHOR

Kazuho Oku

Tatsuhiko Miyagawa

SEE ALSO

Plack::Handler::Standalone Starman Starlet