{"schema":"threatline.record/2","record":{"id":"CVE-2026-113877","aliases":[],"summary":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions","details":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113877","source_modified_at":"2026-10-23T23:06:45.441Z","fetched_at":"2026-10-24T00:31:04.721601Z","product":null,"vendor":null,"versions":[{"lessThan":"0.10","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113877","source_modified_at":"2026-10-23T23:06:45.441Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":null,"ecosystem":null},"version":"0.10","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T20:07:20.677Z","modified_at":"2026-10-23T23:06:45.441Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-113877","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-10-23T23:06:45.441Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T23:06:45.441Z","content_hash":"71d9d90524fa1dbddbccf753635bd1e91cf43f97c082acebd8dcf53634ff0f19"}}