CVE-2026-115825: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-115825 is a denial-of-service vulnerability in HTTP::Server::PSGI (part of the Plack framework for Perl) that allows an unauthenticated remote attacker to crash the server with a single HTTP request by declaring a large Content-Length header. All versions of Plack before 1.0056 are affected. The vulnerability was published on October 25, 2026, and assigned CWE-789 (Memory Allocation with Excessive Size Value). The CVSS category is estimated as Medium (GitHub Advisory, Feedly).

The root cause is that HTTP::Server::PSGI passes the full remaining Content-Length value directly to sysread() as the read buffer size (CWE-789). Perl pre-allocates the read buffer to the requested length before any data arrives, meaning the server attempts to allocate as much memory as the client declares in the header — regardless of how much body data is actually sent. An attacker can send a single HTTP POST request with an arbitrarily large Content-Length (e.g., 100000000000) and only a few bytes of body data; Perl then exits with an "Out of memory!" error before the application layer is ever invoked. The fix, introduced in commit 11545871, caps each sysread() call to a maximum chunk size of 64 KiB (CHUNKSIZE = 64 * 1024), preventing unbounded memory allocation (GitHub Patch, GitHub Advisory).

Successful exploitation causes a permanent denial of service: the HTTP::Server::PSGI process terminates with an out-of-memory error and does not automatically recover, as the server runs as a single process. The server remains completely unavailable until manually restarted, meaning a single unauthenticated request is sufficient to take down the entire service. There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability requires no authentication and no special preconditions — any network-accessible instance of HTTP::Server::PSGI running a version before 1.0056 is exploitable with a trivially crafted HTTP request. The EPSS score is reported as 0.0, and the CVE is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing services running HTTP::Server::PSGI (Plack) versions before 1.0056 using tools like Shodan, Censys, or banner grabbing (e.g., checking the Server: HTTP response header for Plack).
2. Craft malicious request: Construct an HTTP POST request with an extremely large Content-Length header (e.g., Content-Length: 100000000000) and a minimal body payload (e.g., just a few bytes like hello).
3. Send the request: Transmit the crafted request to any HTTP endpoint on the target server. No authentication or special path is required — the vulnerability triggers during body reading, before the application is called.
4. Server crash: Perl attempts to pre-allocate a read buffer matching the declared Content-Length, exhausts available memory, and exits with Out of memory!. The server process terminates and does not restart automatically.
5. Sustained DoS: Repeat the request after any manual restart to maintain denial of service (GitHub Patch, GitHub Advisory).

• Network: Inbound HTTP POST requests with abnormally large Content-Length header values (e.g., values in the gigabyte or terabyte range) but minimal actual body data transferred before the connection closes.
• Logs: Web server or application logs showing a request received immediately followed by process termination; absence of subsequent log entries indicating the server stopped processing.
• Process: Sudden termination of the Perl/HTTP::Server::PSGI process with an "Out of memory!" error message in system logs (e.g., /var/log/syslog, dmesg, or application stderr output).
• System: OOM killer events in kernel logs (dmesg) attributing memory exhaustion to the Perl process serving HTTP requests.

The primary remediation is to upgrade Plack to version 1.0056 or later, which caps sysread() calls to 64 KiB chunks, preventing unbounded memory allocation (GitHub Patch, MetaCPAN). As a workaround prior to patching, deploy a reverse proxy (e.g., nginx, Apache) or load balancer in front of the application configured to reject or limit requests with excessively large Content-Length headers. Network-level rate limiting and request filtering can also reduce exposure. Running HTTP::Server::PSGI behind a process manager (e.g., systemd with Restart=always) can mitigate the availability impact by automatically restarting the process after a crash.

The vulnerability was noted on the Infosec Exchange Mastodon instance shortly after disclosure, and standard CVE tracking services (VulDB, CVE Feed, cve.report) indexed it promptly. No significant vendor statements beyond the patch commit or notable researcher commentary have been identified at this time (Feedly).