/ 
Plack-1.0055
⭐ Starred 488 / Plack::Middleware::BufferedStreaming
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::BufferedStreaming - Enable buffering for non-streaming aware servers

SYNOPSIS

enable "BufferedStreaming";

DESCRIPTION

Plack::Middleware::BufferedStreaming is a PSGI middleware component that wraps the application that uses psgi.streaming interface to run on the servers that do not support the interface, by buffering the writer output to a temporary buffer.

This middleware doesn't do anything and bypass the application if the server supports psgi.streaming interface, unless you set force option (see below).

OPTIONS

force

Force enable this middleware only if the container supports psgi.streaming.

AUTHOR

Yuval Kogman

Tatsuhiko Miyagawa