CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

As cited

Copy frozen at 2026-10-24 01:38 UTC (site build).

vulnerabilities

CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

CVE-2026-113877 affects HTTP::Headers::ActionPack for Perl versions before 0.10, which processes Accept-Language HTTP headers using regular expressions in a way that can be exploited to cause CPU exhaustion. An attacker can craft malicious Accept-Language range headers to trigger excessive computation on affected systems.

Why it matters: Perl developers and system administrators using HTTP::Headers::ActionPack must upgrade to version 0.10 or later to prevent denial of service attacks that exhaust server CPU resources through crafted HTTP requests.

Source published

2026-10-23 22:16 UTC

First seen by Cybersecurity Tracker

2026-10-24 00:39 UTC