{"id":"CVE-2026-113877","kind":"vulnerability","aliases":["CVE-2026-113877"],"related":[],"title":"Perl HTTP::Headers::ActionPack: Accept-Language header causes CPU exhaustion","description":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","summary":"HTTP::Headers::ActionPack before 0.10 interpolates Accept-Language ranges into a regular expression without escaping, so a crafted header makes the regex engine backtrack for seconds. A remote attacker can exhaust CPU or make choose_language die in any application that passes it an untrusted Accept-Language header.","severity":"high","cvss":null,"epss":0.00325,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-headers","package","perl","web-apps"],"not_affected_if":["does-not-use-actionpack","no-untrusted-accept-language"],"how_to_check":"- Check the installed version: `perl -MHTTP::Headers::ActionPack -e 'print $HTTP::Headers::ActionPack::VERSION'` or `cpanm --info HTTP::Headers::ActionPack`\n- Search dependency manifests and lock files (cpanfile, cpanfile.snapshot, Makefile.PL) for HTTP::Headers::ActionPack\n- Check whether application code calls choose_language on request headers","fix":"- Upgrade HTTP::Headers::ActionPack to `0.10` or later\n- Until upgraded, validate or limit Accept-Language header length and content before calling choose_language","status":"open","published_at":"2026-10-23T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:52:05+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:52:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HTTP::Headers::ActionPack to `0.10` or later\n- Until upgraded, validate or limit Accept-Language header length and content before calling choose_language","reach":"internet","title":"Perl HTTP::Headers::ActionPack: Accept-Language header causes CPU exhaustion","impact":"medium","summary":"HTTP::Headers::ActionPack before 0.10 interpolates Accept-Language ranges into a regular expression without escaping, so a crafted header makes the regex engine backtrack for seconds. A remote attacker can exhaust CPU or make choose_language die in any application that passes it an untrusted Accept-Language header.","category":"package","nicknames":[],"who_cares":["perl","web-apps","http-headers"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote request exhausts CPU or crashes language selection code","analyst_note":"","how_to_check":"- Check the installed version: `perl -MHTTP::Headers::ActionPack -e 'print $HTTP::Headers::ActionPack::VERSION'` or `cpanm --info HTTP::Headers::ActionPack`\n- Search dependency manifests and lock files (cpanfile, cpanfile.snapshot, Makefile.PL) for HTTP::Headers::ActionPack\n- Check whether application code calls choose_language on request headers","needs_analyst":false,"not_affected_if":["does-not-use-actionpack","no-untrusted-accept-language"],"who_is_affected":"Perl applications that call HTTP::Headers::ActionPack's choose_language (directly or through a web framework) on the untrusted Accept-Language header of incoming requests. Applications that do not use this module, or that never pass request headers to it, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":3442,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113877':14A,17A '-2026':13A,16A '/i':108C '0.10':30B,81C '12':124C '26':131C 'accept':6A,33B,73B,89C,101C,172C 'accept-languag':5A,32B,72B,88C,100C,171C 'actionpack':4A,28B,78C 'allow':84C 'app':25B 'applic':66B,166C 'attack':55B,155C 'b':130C 'backtrack':50B,133C 'byte':125C 'caus':9A 'choos':61B,161C 'compil':152C 'cpu':10A,58B,85C,158C 'craft':44B 'cve':12A,15A 'die':63B,163C 'doubl':142C 'engin':49B,122C 'escap':41B,110C 'exhaust':11A,57B,86C,157C 'express':39B,95C,114C 'fail':150C 'header':3A,8A,20B,27B,45B,75B,77C,118C,174C 'http':2A,19B,26B,76C 'http-header':18B 'increment':138C 'interpol':31B,98C 'invalid':146C 'languag':7A,34B,62B,74B,90C,96C,102C,162C,173C 'make':46B,60B,160C 'match':92C,97C 'packag':21B 'pass':68B,168C 'pattern':106C 'perl':1A,22B,83C 'quantifi':141C 'rang':35B,91C,103C,107C,126C,147C 'reach':119C 'regex':48B,121C 'regular':38B,94C,113C 'remot':54B,154C 'second':52B,135C 'syntax':115C 'time':144C 'untrust':71B,170C 'version':79C 'via':87C 'web':24B 'web-app':23B 'without':40B,109C 'z':132C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that call HTTP::Headers::ActionPack's choose_language (directly or through a web framework) on the untrusted Accept-Language header of incoming requests. Applications that do not use this module, or that never pass request headers to it, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T21:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113877","severity":null,"published_at":"2026-10-23T21:17:21+00:00","modified_at":"2026-10-23T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113877","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113877","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}