CVE-2026-113877
Description
A flaw was found in HTTP::Headers::ActionPack. A remote attacker can trigger a Denial of Service (DoS) by sending an HTTP request with a crafted Accept-Language header to an affected application. Because language range values are evaluated as regular expression patterns without proper sanitization, malicious input can cause excessive CPU consumption or cause the application process to terminate unexpectedly.
Statement
A regular expression denial of service (ReDoS) exists in HTTP::Headers::ActionPack before 0.10: Accept-Language language ranges are interpolated unescaped into a regular expression in _language_match, so a crafted range can cause catastrophic backtracking (CPU exhaustion) and an invalid range can make choose_language die. The fix in 0.10 replaces the regex interpolation with equality/substring comparison.
Mitigation
Upgrade to HTTP::Headers::ActionPack 0.10 or later; alternatively filter/validate Accept-Language ranges before passing them to HTTP::Headers::ActionPack content negotiation.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unescaped regular expression evaluation of Accept-Language header ranges in HTTP content negotiation: upgrade to HTTP::Headers::ActionPack 0.10 (or the fixed Perl Http Headers Actionpack builds), which replace regular expression matching with lowercased substring comparison using substr, closing all 2 injection vectors (catastrophic ReDoS backtracking via crafted quantifiers, uncompilable regular expression syntax triggering process termination). Until patched, this is a concern on applications using HTTP::Headers::ActionPack accepting untrusted Accept-Language headers, so filter and validate incoming Accept-Language header ranges against strict language tag formats to reject regular expression syntax before content negotiation. These controls limit blast radius and contain exploitation, but they do not fix the underlying unescaped regular expression interpolation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
