CVE-2026-113877

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113877", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-20T20:16:52.798Z", "datePublished": "2026-10-23T20:07:20.677Z", "dateUpdated": "2026-11-02T15:59:52.574Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Headers::ActionPack"], "packageName": "HTTP-Headers-ActionPack", "packageURL": "pkg:cpan/HTTP-Headers-ActionPack", "programFiles": ["lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"], "programRoutines": [{"name": "HTTP::Headers::ActionPack::ContentNegotiation::_language_match"}, {"name": "HTTP::Headers::ActionPack::ContentNegotiation::choose_language"}], "repo": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/", "versions": [{"lessThan": "0.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-624", "description": "CWE-624 Executable Regular Expression Error", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-23T20:07:20.677Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes"}, {"tags": ["patch"], "url": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Headers-ActionPack 0.10 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/23/27"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-23T23:06:45.441Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T15:59:32.790611Z", "id": "CVE-2026-113877", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:59:52.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/23/27"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-23T23:06:45.441Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-113877", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T15:59:32.790611Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:59:45.433Z"}}], "cna": {"title": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/", "modules": ["HTTP::Headers::ActionPack"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.10", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Headers-ActionPack", "packageName": "HTTP-Headers-ActionPack", "programFiles": ["lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Headers::ActionPack::ContentNegotiation::_language_match"}, {"name": "HTTP::Headers::ActionPack::ContentNegotiation::choose_language"}]}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Headers-ActionPack 0.10 or later."}], "references": [{"url": "https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes", "tags": ["release-notes"]}, {"url": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch", "tags": ["patch"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-624", "description": "CWE-624 Executable Regular Expression Error"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-23T20:07:20.677Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113877", "state": "PUBLISHED", "dateUpdated": "2026-11-02T15:59:52.574Z", "dateReserved": "2026-10-20T20:16:52.798Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-23T20:07:20.677Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Headers::ActionPack"], "packageName": "HTTP-Headers-ActionPack", "packageURL": "pkg:cpan/HTTP-Headers-ActionPack", "programFiles": ["lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"], "programRoutines": [{"name": "HTTP::Headers::ActionPack::ContentNegotiation::_language_match"}, {"name": "HTTP::Headers::ActionPack::ContentNegotiation::choose_language"}], "repo": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/", "versions": [{"lessThan": "0.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it."}], "id": "CVE-2026-113877", "lastModified": "2026-11-02T16:17:27.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-113877", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T15:59:32.790611Z", "version": "2.0.3"}}]}, "published": "2026-10-23T21:17:21.597", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/27"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-624"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-http-headers-actionpack: HTTP::Headers::ActionPack: Denial of Service via crafted Accept-Language headers", "id": "2560178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560178"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.", "A flaw was found in HTTP::Headers::ActionPack. A remote attacker can trigger a Denial of Service (DoS) by sending an HTTP request with a crafted Accept-Language header to an affected application. Because language range values are evaluated as regular expression patterns without proper sanitization, malicious input can cause excessive CPU consumption or cause the application process to terminate unexpectedly."], "mitigation": {"lang": "en:us", "value": "Upgrade to HTTP::Headers::ActionPack 0.10 or later; alternatively filter/validate Accept-Language ranges before passing them to HTTP::Headers::ActionPack content negotiation."}, "name": "CVE-2026-113877", "public_date": "2026-10-23T20:07:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-113877\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-113877\nhttps://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch\nhttps://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes"], "statement": "A regular expression denial of service (ReDoS) exists in HTTP::Headers::ActionPack before 0.10: Accept-Language language ranges are interpolated unescaped into a regular expression in _language_match, so a crafted range can cause catastrophic backtracking (CPU exhaustion) and an invalid range can make choose_language die. The fix in 0.10 replaces the regex interpolation with equality/substring comparison.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http::headers::actionpack", "vendor": "perl"}], "created": "2026-10-23T21:45:14.444769+00:00", "updated": "2026-11-03T16:37:56.179861+00:00", "vendors": ["perl", "perl$PRODUCT$http::headers::actionpack"]}