PatchTheCVECVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matche
0
Routine
HIGH n/a
CVE-2026-113877 is a high-severity flaw (CVSS n/a) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | n/a (High) |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-624 |
| Published | 2026-10-23 |
| Last modified | 2026-10-23 |
Publisher (CNA): CPANSec
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- oss-security list: CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular 2026-10-23
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.