/ 
Plack-1.0055
⭐ Starred 488 / Plack::Middleware::Lint
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::Lint - Validate request and response

SYNOPSIS

use Plack::Middleware::Lint;

my $app = sub { ... }; # your app or middleware
$app = Plack::Middleware::Lint->wrap($app);

# Or from plackup
plackup -e 'enable "Lint"' myapp.psgi

DESCRIPTION

Plack::Middleware::Lint is a middleware component to validate request and response environment formats. You are strongly suggested to use this middleware when you develop a new framework adapter or a new PSGI web server that implements the PSGI interface.

This middleware is enabled by default when you run plackup or other launcher tools with the default environment development value.

DEBUGGING

Because of how this middleware works, it may not be easy to debug Lint errors when you encounter one, unless you're writing a PSGI web server or a framework.

For example, when you're an application developer (user of some framework) and see errors like:

Body should be an array ref or filehandle at lib/Plack/Middleware/Lint.pm line XXXX

there's no clue about which line of your application produces that error.

We're aware of the issue, and have a plan to spit out more helpful errors to diagnose the issue. But until then, currently there are some workarounds to make this easier. For now, the easiest one would be to enable Plack::Middleware::REPL outside of the Lint middleware, like:

plackup -e 'enable "REPL"; enable "Lint"' app.psgi

so that the Lint errors are caught by the REPL shell, where you can inspect all the variables in the response.

AUTHOR

Tatsuhiko Miyagawa

Tokuhiro Matsuno

SEE ALSO

Plack