Read the docs
TI-2026-79982 Aliases CVE-2026-113877GHSA-q4hv-hfj9-x4r5

Regex injection in HTTP::Headers::ActionPack enables CPU exhaustion

Priority MEDIUM 40CWE-624Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

HTTP-Headers-ActionPack for Perl versions from 0 before 0.10 is affected. Each Accept-Language range is inserted into a regular expression without escaping, so regex syntax in the header reaches the regex engine (CWE-624). A remote attacker who sends a crafted Accept-Language header can exhaust CPU or make choose_language die in any application that passes untrusted headers to it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile. A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00708 53rd percentileScored 2026-11-07
Fix Fixed HTTP-Headers-ActionPack: 0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HTTP-Headers-ActionPackbefore 0.100.10Patch availableCNA
  • HTTP-Headers-ActionPack Vendor— Affected before 0.10 Fixed in 0.10 Patch available CNA

Remediation

Update HTTP-Headers-ActionPack to version 0.10, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA HTTP-Headers-ActionPack Fixed in 0.10

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-113877
  2. 2026-10-23 Alias added: GHSA-q4hv-hfj9-x4r5
  3. 2026-10-29 Affected versions changed · Red Hat
  4. 2026-10-29 CVSS score added · Red Hat
  5. 2026-11-02 CVSS score added · CISA ADP
  6. 2026-11-02 CISA SSVC decision points changed
  7. 2026-11-03 EPSS moved to the 50th–90th percentile
  8. 2026-11-04 Priority changed: LOW → MEDIUM

References

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences