Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115825— HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

Quick assessment

Affected
CVE-2026-115825
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 HTTP::Server::PSGI 模块在 1.0056 版本之前存在漏洞：攻击者可通过发送一个声明了超大 Content-Length 值的单一请求，导致服务器崩溃。 该漏洞的成因在于，服务器使用 sysread() 调用读取请求体，其每次读取的大小由剩余的 Content-Length 值决定。Perl 会在任何实际数据到达之前，预先将读取缓冲区扩展至请求指定的长度。因此，服务器会尝试分配与客户端声明的 Content-Length 值等量的内存。 远程攻击者只需发送一个包含超大 Content

AI Predicted 5.0 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

I. Basic Information for CVE-2026-115825

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.0056 -

II. Public POCs for CVE-2026-115825

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115825

请登录查看更多情报信息。

Other References for CVE-2026-115825 (2)

IV. Related Vulnerabilities

Same weakness: CWE-789