/ 
Plack-1.0055
⭐ Starred 488 / Plack::Runner
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Runner - plackup core

SYNOPSIS

# Your bootstrap script
use Plack::Runner;
my $app = sub { ... };

my $runner = Plack::Runner->new;
$runner->parse_options(@ARGV);
$runner->run($app);

DESCRIPTION

Plack::Runner is the core of plackup runner script. You can create your own frontend to run your application or framework, munge command line options and pass that to run method of this class.

run method does exactly the same thing as the plackup script does, but one notable addition is that you can pass a PSGI application code reference directly to the method, rather than via .psgi file path or with -e switch. This would be useful if you want to make an installable PSGI application.

Also, when -h or --help switch is passed, the usage text is automatically extracted from your own script using Pod::Usage.

NOTES

Do not directly call this module from your .psgi, since that makes your PSGI application unnecessarily depend on plackup and won't run other backends like Plack::Handler::Apache2 or mod_psgi.

If you really want to make your .psgi runnable as a standalone script, you can do this:

my $app = sub { ... };

unless (caller) {
    require Plack::Runner;
    my $runner = Plack::Runner->new;
    $runner->parse_options(@ARGV);
    $runner->run($app);
    exit 0;
}

return $app;

WARNING: this section used to recommend if (__FILE__ eq $0) but it's known to be broken since Plack 0.9971, since $0 is now always set to the .psgi file path even when you run it from plackup.

SEE ALSO

plackup