{"schema_version":"1","data":[{"id":19316,"advisory_id":"534f7178-c4a7-4a8e-a8de-6c3cbff207f5","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/363","source_published_at":"2026-10-23T22:16:18+00:00","published_at":"2026-10-25T02:33:22.57352+00:00","extraction_method":"llm","technologies":["http-headers-actionpack","oss-security"],"cve_ids":["CVE-2026-113877"],"event_types":["patch"],"payload":{"kind":"patch","title":"CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions","summary":"Unescaped Accept-Language ranges can trigger excessive regular-expression backtracking and CPU exhaustion. Upgrade to version 0.10 or later.","evidence":"A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","products":[{"name":{"value":"HTTP-Headers-ActionPack","evidence":"Distribution: HTTP-Headers-ActionPack"},"prerequisites":[{"value":"passes an untrusted Accept-Language header to it","evidence":"in any application that passes an untrusted Accept-Language header to it."}],"fixed_versions":[{"value":"0.10 or later","evidence":"Upgrade to HTTP-Headers-ActionPack 0.10 or later."}],"affected_versions":[{"value":"before 0.10","evidence":"Versions: before 0.10"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-113877","evidence":"CVE ID: CVE-2026-113877"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19316,"next_before":19316}