CVE-2026-115825None▾ SunlitHTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.
A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
Plack < 1.0056Upgrade to Plack 1.0057 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116095Medium· 5.3smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
CVE-2026-114629NoneWeb::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
CVE-2026-115417High· 7.5aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation (CVE-2026-115417)
CVE-2026-115394Medium· 5.5Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation
CVE-2026-108359High· 8.7PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser