========================================================================
CVE-2026-113877                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-113877

   Distribution:  HTTP-Headers-ActionPack
       Versions:  before 0.10
       MetaCPAN: https://metacpan.org/dist/HTTP-Headers-ActionPack
       VCS Repo: https://github.com/robrwo/perl-HTTP-Headers-ActionPack/

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU
exhaustion via Accept-Language ranges matched as regular expressions

Description
-----------
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU
exhaustion via Accept-Language ranges matched as regular expressions.

_language_match interpolates each Accept-Language range into the
pattern `/^$range\-/i` without escaping it, so regular expression
syntax in the header reaches the regex engine. A 12-byte range such as
`(a?|b?){26}z` backtracks for seconds, and each increment of the
quantifier doubles the time. An invalid range such as `(` fails to
compile.

A remote attacker can exhaust CPU, or make choose_language die, in any
application that passes an untrusted Accept-Language header to it.

Problem types
-------------
- CWE-624 Executable Regular Expression Error

Solutions
---------
Upgrade to HTTP-Headers-ActionPack 0.10 or later.

References
----------
https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes
https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch