CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions
Unescaped Accept-Language ranges can trigger excessive regular-expression backtracking and CPU exhaustion. Upgrade to version 0.10 or later.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.
HTTP-Headers-ActionPack
Distribution: HTTP-Headers-ActionPack
- Affected versions
- before 0.10
Versions: before 0.10
- Fixed versions
- 0.10 or later
Upgrade to HTTP-Headers-ActionPack 0.10 or later.
- Prerequisites
- passes an untrusted Accept-Language header to it
in any application that passes an untrusted Accept-Language header to it.
- Related CVEs
- CVE-2026-113877
CVE ID: CVE-2026-113877
Publisher severity
No explicit severity was extracted.