{"id":"DEBIAN-CVE-2026-113877","details":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.  _language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.  A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","modified":"2026-10-24T11:00:10.963517652Z","published":"2026-10-23T21:17:21.597Z","upstream":["CVE-2026-113877"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-113877"}],"affected":[{"package":{"name":"libhttp-headers-actionpack-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libhttp-headers-actionpack-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.09-2","0.09-3","0.09-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113877.json"}},{"package":{"name":"libhttp-headers-actionpack-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libhttp-headers-actionpack-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.09-3","0.09-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113877.json"}},{"package":{"name":"libhttp-headers-actionpack-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libhttp-headers-actionpack-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.09-3","0.09-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113877.json"}}],"schema_version":"1.9.0"}