---
id: CVE-2026-113877
title: >-
  HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion
  via Accept-Language ranges matched as regular expressions
summary: >-
  HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion
  via Accept-Language ranges matched as regular expressions.


  _language_match interpolates each Accept-Language range into the pattern
  `/^$range\-/i` without esca…
severity: none
cwe:
  - CWE-624
product: HTTP-Headers-ActionPack
affected:
  - HTTP-Headers-ActionPack < 0.10
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:07:20.677Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113877'
references:
  - url: 'https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes'
  - url: >-
      https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch
tags:
  - cve.org
ingestedAt: '2026-10-23T20:36:51.532Z'
---

## Overview

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.

_language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.

A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.

## Affected

- `HTTP-Headers-ActionPack < 0.10`

## Remediation

Upgrade to HTTP-Headers-ActionPack 0.10 or later.