CVE-2026-40561

@@ -296,6 +296,17 @@ sub handle_connection {
             $buf = substr $buf, $reqlen;
             my $chunked = do { no warnings; lc delete $env->{HTTP_TRANSFER_ENCODING} eq 'chunked' };
 
+            # If a message is received with both a Transfer-Encoding and a
+            # Content-Length header field, the Transfer-Encoding overrides the
+            # Content-Length.  Such a message might indicate an attempt to
+            # perform request smuggling (Section 9.5) or response splitting
+            # (Section 9.4) and ought to be handled as an error.  A sender MUST
+            # remove the received Content-Length field prior to forwarding such
+            # a message downstream.
+            if ($chunked && $env->{CONTENT_LENGTH}) {
+                last; # Return bad response.
+            }
+
             if ( $env->{HTTP_EXPECT} ) {
                 if ( lc $env->{HTTP_EXPECT} eq '100-continue' ) {
                     $self->write_all($conn, "HTTP/1.1 100 Continue\015\012\015\012")
@@ -307,6 +318,10 @@ sub handle_connection {
             }
 
             if (my $cl = $env->{CONTENT_LENGTH}) {
+                if ($cl !~ /^[0-9]+$/) { # content-length header must be digits.
+                    last; # Return bad response
+                }
+
                 my $buffer = Plack::TempBuffer->new($cl);
                 while ($cl > 0) {
                     my $chunk;

@@ -0,0 +1,59 @@
+use strict;
+use Test::TCP;
+use Plack::Test;
+use HTTP::Request;
+use HTTP::Message::PSGI;
+use Test::More;
+use Digest::MD5;
+use Plack::Test::Server;
+use Test::TCP;
+use IO::Socket::INET;
+
+$ENV{PLACK_SERVER} = 'Starlet';
+
+my $app = sub {
+    my $env = shift;
+    my $body;
+    my $clen = $env->{CONTENT_LENGTH};
+    while ($clen > 0) {
+        $env->{'psgi.input'}->read(my $buf, $clen) or last;
+        $clen -= length $buf;
+        $body .= $buf;
+    }
+    return [ 200, [ 'Content-Type', 'text/plain', 'X-Content-Length', $env->{CONTENT_LENGTH} ], [ $body ] ];
+};
+
+my $server = Test::TCP->new(
+    code => sub {
+        my $sock_or_port = shift;
+        my $server = Plack::Loader->auto(
+            port => $sock_or_port,
+            host => '127.0.0.1'
+        );
+        $server->run($app);
+        exit;
+    },
+);
+
+my $sock = IO::Socket::INET->new(
+    PeerAddr => '127.0.0.1',
+    PeerPort => $server->port,
+    Proto => 'tcp',
+);
+
+print {$sock} (
+    "GET / HTTP/1.1\015\012"
+    . "content-length: 3\015\012"
+    . "Transfer-Encoding: chunked\015\012"
+    . "connection: close\015\012"
+    . "\015\012"
+    . "8\015\012"
+    . "SMUGGLED\015\012"
+    . "0\015\012"
+);
+
+my $res_str = do { local $/; <$sock> };
+my ($status_line, ) = split /\015\012/, $res_str;
+is $status_line, 'HTTP/1.1 400 Bad Request';
+
+done_testing;

@@ -0,0 +1,57 @@
+use strict;
+use Test::TCP;
+use Plack::Test;
+use HTTP::Request;
+use HTTP::Message::PSGI;
+use Test::More;
+use Digest::MD5;
+use Plack::Test::Server;
+use Test::TCP;
+use IO::Socket::INET;
+
+$ENV{PLACK_SERVER} = 'Starlet';
+
+my $app = sub {
+    my $env = shift;
+    my $body;
+    my $clen = $env->{CONTENT_LENGTH};
+    while ($clen > 0) {
+        $env->{'psgi.input'}->read(my $buf, $clen) or last;
+        $clen -= length $buf;
+        $body .= $buf;
+    }
+    return [ 200, [ 'Content-Type', 'text/plain', 'X-Content-Length', $env->{CONTENT_LENGTH} ], [ $body ] ];
+};
+
+my $server = Test::TCP->new(
+    code => sub {
+        my $sock_or_port = shift;
+        my $server = Plack::Loader->auto(
+            port => $sock_or_port,
+            host => '127.0.0.1'
+        );
+        $server->run($app);
+        exit;
+    },
+);
+
+my $sock = IO::Socket::INET->new(
+    PeerAddr => '127.0.0.1',
+    PeerPort => $server->port,
+    Proto => 'tcp',
+);
+
+print {$sock} (
+    "GET / HTTP/1.1\015\012"
+    . "content-length: 3\015\012"
+    . "content-length: 9\015\012"
+    . "connection: close\015\012"
+    . "\015\012"
+    . "123456789"
+);
+
+my $res_str = do { local $/; <$sock> };
+my ($status_line, ) = split /\015\012/, $res_str;
+is $status_line, 'HTTP/1.1 400 Bad Request';
+
+done_testing;