{"id":"CVE-2026-113877","state":"PUBLISHED","title":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions","description":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","publishedAt":"2026-10-23T20:07:20.677Z","updatedAt":"2026-10-23T23:06:45.441Z","severity":null,"assigner":"CPANSec","products":["HTTP-Headers-ActionPack"],"affected":[{"packageName":"HTTP-Headers-ActionPack","packageURL":"pkg:cpan/HTTP-Headers-ActionPack","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.10","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["HTTP::Headers::ActionPack"],"programFiles":["lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"],"programRoutines":[{"name":"HTTP::Headers::ActionPack::ContentNegotiation::_language_match"},{"name":"HTTP::Headers::ActionPack::ContentNegotiation::choose_language"}],"repo":"https://github.com/robrwo/perl-HTTP-Headers-ActionPack/"}],"references":["https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes","https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch","http://www.openwall.com/lists/oss-security/2026/10/23/27"],"weaknesses":["CWE-624"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/113xxx/CVE-2026-113877.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-113877","state":"PUBLISHED","datePublished":"2026-10-23T20:07:20.677Z","dateUpdated":"2026-10-23T23:06:45.441Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-10-20T20:16:52.798Z"},"containers":{"cna":{"title":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions","descriptions":[{"lang":"en","value":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it."}],"affected":[{"packageName":"HTTP-Headers-ActionPack","packageURL":"pkg:cpan/HTTP-Headers-ActionPack","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.10","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["HTTP::Headers::ActionPack"],"programFiles":["lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"],"programRoutines":[{"name":"HTTP::Headers::ActionPack::ContentNegotiation::_language_match"},{"name":"HTTP::Headers::ActionPack::ContentNegotiation::choose_language"}],"repo":"https://github.com/robrwo/perl-HTTP-Headers-ActionPack/"}],"references":[{"url":"https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes","tags":["release-notes"]},{"url":"https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch","tags":["patch"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-624","description":"CWE-624 Executable Regular Expression Error","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-10-23T20:07:20.677Z"},"solutions":[{"lang":"en","value":"Upgrade to HTTP-Headers-ActionPack 0.10 or later."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/27"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-23T23:06:45.441Z"}}]}}}