[SECURITY]
- Fix HTTP::Server::PSGI allocating a buffer as large as the declared Content-Length,
which let a single request crash the server with "Out of memory!" (CVE-2026-115825)
[BUG FIXES]
- Fix HTTP::Server::PSGI passing bytes after the Content-Length body to the app in psgi.input
- Fix HTTP::Server::PSGI accepting malformed, negative, duplicate or too long (more than
18 digits) Content-Length. Such requests now get 400 Bad Request
- Fix HTTP::Server::PSGI ignoring Transfer-Encoding and passing the raw chunked body to the app.
Such requests now get 501 Not Implemented
- Fix HTTP::Server::PSGI passing stray bytes after the headers as psgi.input when the request
has no Content-Length or a Content-Length of 0