Hi,

The following vulnerability was published for libplack-perl.

CVE-2026-115825[0]:
| HTTP::Server::PSGI versions before 1.0056 for Perl allow a single
| request to crash the server by declaring a large Content-Length.
| The request body is read with sysread() calls sized by the remaining
| Content-Length. Perl grows the read buffer to the requested length
| before any data arrives, so the server tries to allocate as much
| memory as the client declares.  A remote attacker can send one
| request with a large Content-Length and a few body bytes, and perl
| exits with an out-of-memory error before the application is called.
| HTTP::Server::PSGI runs as a single process, so the server stays
| down until restarted.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115825
https://www.cve.org/CVERecord?id=CVE-2026-115825
[1] https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a
[2] https://lists.security.metacpan.org/cve-announce/msg/44625163/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libplack-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152055@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libplack-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 25 Oct 2026 23:38:54 +0100
Source: libplack-perl
Architecture: source
Version: 1.0057-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1152055
Changes:
 libplack-perl (1.0057-1) unstable; urgency=medium
 .
   * Import upstream version 1.0057.
     Since 1.0056:
     - Fix HTTP::Server::PSGI allocating a buffer as large as the declared
       Content-Length, which let a single request crash the server with "Out of
       memory!" (CVE-2026-115825)
     Closes: #1152055
Checksums-Sha1:
 8b96b051c8d4165fb11a4d2ce3197c0fed37859f 3450 libplack-perl_1.0057-1.dsc
 388c41698f28eedc7eb6339d95c4fb39aa1d416a 203316 libplack-perl_1.0057.orig.tar.gz
 401f036bad36056c60b9909b2ac8de67161995a1 7196 libplack-perl_1.0057-1.debian.tar.xz
 78ab2fce995c0002c301cd620eeb0b19f6aa931a 372196 libplack-perl_1.0057-1.git.tar.xz
 ac99303d8721bd4e8c51d83a09531b4d888103ad 17760 libplack-perl_1.0057-1_source.buildinfo
Checksums-Sha256:
 23de2b66710c5b936a8ac69dde34b0efb05681c3eb47593420db2960dfa9fcb6 3450 libplack-perl_1.0057-1.dsc
 01cfe036276703f62cf6c1cec7c7e630420677498dfa7bc333ad88eca9d7a765 203316 libplack-perl_1.0057.orig.tar.gz
 579f7599e6734c0cb61f47ddf160f5db88434bae36648190b2925dfbc5e24174 7196 libplack-perl_1.0057-1.debian.tar.xz
 0913955a228be976cff95e53754bba8cdafee386ea43faaf47c9a0ee0cff9eb1 372196 libplack-perl_1.0057-1.git.tar.xz
 6fafed9ea4d8384b9f404cf5393084d6fd87e95019a6d31066e3958e4ac8dc83 17760 libplack-perl_1.0057-1_source.buildinfo
Files:
 a28aa1b9a92270d4f8819f02a64acd10 3450 perl optional libplack-perl_1.0057-1.dsc
 e9962275809ab5ec3891362dc16ebf06 203316 perl optional libplack-perl_1.0057.orig.tar.gz
 ae95b609fe21d6cc88292df3e55c1b51 7196 perl optional libplack-perl_1.0057-1.debian.tar.xz
 a18c144213099d41a4196dae4802c62b 372196 perl None libplack-perl_1.0057-1.git.tar.xz
 1923f88ba257f44cf37c6a1b21258d9a 17760 perl optional libplack-perl_1.0057-1_source.buildinfo
Git-Tag-Info: tag=4f197ba078ff13b1e60059f2f586fc38f1bac983 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrehmYACgkQYG0ITkaD
wHljqQ/+KpBYazZcfdcTD+9oH3/+Cxm427CcEOK2llwmKMq/n/GPZ0ecMoPXbrD6
qOiBanRnWXqTCh+PSI38WLxyklmG12cP7ynYZlFtAYDXUESwSR8K4AqJ56sBKphj
DAzC8gOL/C16NfdN8E+//KiWirCbwC4WP5Q2W1iOWmEfkW0C1H0JfCql0XsLvY06
uw5Ho/fhpLsgGkGd1Z2W5lr0KbCwmQkT8WumX8QcOZPcQgBQpGXYdpJwpoxcM+QO
RsntFi9s3sfTp5RKcap2Z5aym+N4zFhwZ+JR87mbYnOWEgn6vORAguo2YwSXw8bI
27gNaAlCGcGN8s1/Sx/yZfKksU5r6v/f/YI4LeQx/x5HYjjeeDStgoMgMJCO88Kn
k+KZPfFPkNZZO67m5P0Rd9GZzNjdC6Ux8I567srZzarOhS/FiGwG4VIlhELvqnU/
RIlFsYBIlmI5i0aHMBmdo/suBlDKpzCTzXpZiLHHIE31NaTCPVEGfo/fjCTHC6w0
iwis1TU+bB+qjg9U8noBea3h4VRq8Ggtr4OGSZ1Rex8/F11V6LyI5Ya/zC151Jdi
b2d3iOWI+WMm10w9yyxxpSg6HfN/Fqo4LRQULw/980yhwZjHkjjFTMTK3SdPOtsq
wip6f2Te7YgTUHDOK89BmjqP9z9d+B7udqMlQ/kmB3G9mHtjUSo=
=yUW4
-----END PGP SIGNATURE-----