HTTP::Headers::ActionPack before 0.10 can exhaust CPU (CVE-2026-113877)
Original title: CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions
Accept-Language ranges are matched as regular expressions, which can burn CPU on crafted input.
Robert Rothenberg reported CVE-2026-113877 in the Perl distribution HTTP::Headers::ActionPack. Versions before 0.10 can exhaust CPU when Accept-Language ranges are matched as regular expressions. The oss-security note points to the MetaCPAN distribution page; the message body beyond the title was not included.
Unconfirmed: Only the advisory title was available, so further impact and exploit status are not stated.
- Posted to oss-security by Robert Rothenberg on October 23.
- Affected product is Perl HTTP::Headers::ActionPack before 0.10.
- The trigger is Accept-Language ranges compiled as regular expressions.
Impact: CPU exhaustion from crafted Accept-Language ranges
| Product | Affected | Fixed in |
|---|---|---|
| HTTP::Headers::ActionPack | before 0.10 | 0.10 |
- 1.Upgrade HTTP::Headers::ActionPack to 0.10 or later.
- CVEs
- CVE-2026-113877
- Products
- HTTP::Headers::ActionPack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113877 | HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions | 7.5 | — |
From the original article
Posted by Robert Rothenberg on Oct 23 ======================================================================== https://metacpan. org/dist/HTTP-Headers-ActionPack VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.