Is CVE-2026-115825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115825 being exploited in the wild.

How severe is CVE-2026-115825?

Informational severity, published 25 October 2026.

Which products and versions are affected?

CPAN HTTP::Server::PSGI before 1.0056.

How is CVE-2026-115825 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115825?

Check whether you run CPAN HTTP::Server::PSGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115825: HTTP::Server::PSGI memory exhaustion via large Content-Length

CVE-2026-115825 · Severity: info · Published 2026-10-25

HTTP::Server::PSGI is a Perl-based web server commonly used for PSGI applications. A remote attacker can send a single HTTP request declaring an extremely large Content-Length header with minimal body data, causing the server to attempt a massive memory allocation and crash with an out-of-memory error. Since the server runs as a single process, it remains offline until manually restarted.

Vendors: CPAN.

Quick answers

Is CVE-2026-115825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115825 being exploited in the wild.
How severe is CVE-2026-115825?: Informational severity, published 25 October 2026.
Which products and versions are affected?: CPAN HTTP::Server::PSGI before 1.0056.
Is there a fix for CVE-2026-115825?: Yes: fixed in HTTP::Server::PSGI 1.0056. Until then: Restrict the maximum Content-Length header that the server will accept, or place HTTP::Server::PSGI behind a reverse proxy or load balancer that enforces reasonable request size limits. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115825 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115825?: Check whether you run CPAN HTTP::Server::PSGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: HTTP::Server::PSGI 1.0056

Restrict the maximum Content-Length header that the server will accept, or place HTTP::Server::PSGI behind a reverse proxy or load balancer that enforces reasonable request size limits.

Technical details

HTTP::Server::PSGI's sysread() call passes the full remaining Content-Length as the read size parameter; Perl pre-allocates the read buffer to this size before any data arrives, allowing an attacker to force unbounded memory allocation. A remote unauthenticated attacker can crash the server with a single malformed HTTP request by declaring a Content-Length in the gigabyte range. The fix caps body reads at 64 KiB chunks, preventing excessive buffer allocation.

Affected products

CPAN HTTP::Server::PSGI before 1.0056

Timeline

2026-10-25: disclosed
2026-10-23: patched: Patch released prior to public disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.