Plack: HTTP::Server::PSGI denial of service via Content-Length header (CVE-2026-115825)
HTTP::Server::PSGI versions before 1.0056 are susceptible to a remote denial-of-service vulnerability triggered by an excessively large Content-Length header.
CVE search metadata
CVE search record: CVE-2026-115825. KEV: no. Product: Plack (< 1.0056). Brief: Plack: HTTP::Server::PSGI denial of service via Content-Length header (CVE-2026-115825). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2026-115825-plack/
Triage facts
Revision 1- Applicability
- Plack (< 1.0056)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 26, 02:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Plack versions prior to 1.0056 contain a vulnerability in the HTTP::Server::PSGI component (CVE-2026-115825). A remote attacker can crash the server by sending a single HTTP request with an excessively large Content-Length header, which leads to resource exhaustion and service unavailability.
Impact
The vulnerability allows an unauthenticated attacker to cause a denial-of-service by crashing the server process.
Recommendation
Update the Plack distribution to version 1.0056 or later to mitigate the vulnerability.
Threat Hunt
Identify HTTP requests with unusually large Content-Length headers
Data: Web server access logs
Mitigations
Upgrade Plack to version 1.0056 or later
CVE-2026-115825