Bug#1152055: libplack-perl: CVE-2026-115825

[Salvatore Bonaccorso]

Source: libplack-perl
Version: 1.0055-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libplack-perl.

CVE-2026-115825[0]:
| HTTP::Server::PSGI versions before 1.0056 for Perl allow a single
| request to crash the server by declaring a large Content-Length.
| The request body is read with sysread() calls sized by the remaining
| Content-Length. Perl grows the read buffer to the requested length
| before any data arrives, so the server tries to allocate as much
| memory as the client declares.  A remote attacker can send one
| request with a large Content-Length and a few body bytes, and perl
| exits with an out-of-memory error before the application is called.
| HTTP::Server::PSGI runs as a single process, so the server stays
| down until restarted.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115825
    https://www.cve.org/CVERecord?id=CVE-2026-115825
[1] https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a
[2] https://lists.security.metacpan.org/cve-announce/msg/44625163/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore