Regular Expression Denial of Service in HTTP::Headers::ActionPack for Perl
CVE-2026-113877
Currently unrated
What is CVE-2026-113877?
The HTTP::Headers::ActionPack library for Perl is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to improper handling of the Accept-Language header. The library allows untrusted input to be interpolated into regular expression patterns without sufficient escaping, which can lead to CPU exhaustion. An attacker can exploit this vulnerability by sending specially crafted Accept-Language ranges that cause significant backtracking in the regular expression engine, leading to increased processing time and potentially crashing the application. This vulnerability highlights the risks associated with unsanitized user input and serves as a reminder to implement robust validation and escaping mechanisms.