Technical impact
HTTP::Server::PSGI versions before 1.0056 permit an attacker to crash the Perl server by sending a request that declares an excessively large Content-Length. The module reads the body with sysread calls sized to the remaining Content-Length, causing Perl to allocate a buffer equal to the declared length before any data arrives. When the requested buffer cannot be allocated, the process terminates with an out‑of‑memory error. The crash occurs after a single request and does not result in arbitrary code execution, but it effectively denies service to all clients until the application is restarted.
Affected Systems
Any installation of Perl HTTP::Server::PSGI (part of Plack) that uses an unpatched version earlier than 1.0057. The problem exists in all pre‑1.0056 releases and has been fixed by the 1.0057 update.
Risk and Exploitability
The vulnerability can be triggered by a single malformed HTTP request, making it easy to execute from anywhere over the network. Because the server runs as a single process, a successful attack permanently brings the service down until a manual restart occurs. The CVSS score is 7.5, and the EPSS score is < 1%. The nature of the flaw is an out‑of‑memory denial of service, which is generally considered a high‑impact security issue. The vulnerability is not listed in CISA KEV, indicating it has not yet been reported as actively exploited.
