Cyber ·
CVE-2026-113877: CPU exhaustion in Perl's HTTP::Headers::ActionPack via Accept-Language ranges
Advisory published on October 23, 2026 in the oss-sec feed by the CPAN Security Group. Perl HTTP::Headers::ActionPack versions before 0.10 match Accept-Language ranges as regular expressions, allowing CPU exhaustion.
Advisory CVE-2026-113877 was published on the oss-sec feed on October 23, 2026 by Robert Rothenberg, with information from the CPAN Security Group. The affected distribution is HTTP-Headers-ActionPack for Perl. Versions before 0.10 allow CPU exhaustion when Accept-Language header ranges are matched as regular expressions. According to the text, version 0.10 fixes the problem. The feed content is an automatic translation; to confirm the description, the fixed version and the change history, consult the original oss-sec post and the package page on MetaCPAN, both linked in the advisory itself. This item is a security advisory and does not describe a Rota Nacional feature.