CVE-2026-113877 RRWO CVE debrief

Who should care

Defenders responsible for Perl applications using HTTP::Headers::ActionPack, especially those handling untrusted HTTP headers, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-113877 is a high-severity vulnerability in HTTP::Headers::ActionPack that allows CPU exhaustion via specially crafted Accept-Language headers. Defenders should prioritize verifying exposure, applying patches, and monitoring for potential exploitation attempts.

• CPU exhaustion can lead to denial-of-service conditions in affected applications.
• Successful exploitation can cause applications to become unresponsive or die.
• Defenders must verify application exposure and patch or mitigate vulnerable versions.
• Remediation priority is high due to potential for easy exploitation and significant impact.

Technical summary

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. The _language_match function interpolates each Accept-Language range into a pattern without escaping it, allowing regular expression syntax in the header to reach the regex engine. A remote attacker can exhaust CPU or cause choose_language to die in any application that passes an untrusted Accept-Language header to it.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for HTTP::Headers::ActionPack versions before 0.10.

Recommended defensive actions

• Verify exposure by checking application usage of HTTP::Headers::ActionPack and versions in use.
• Apply patches or updates to HTTP::Headers::ActionPack version 0.10 or later.
• Monitor for and restrict untrusted Accept-Language headers in applications using vulnerable versions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor confirmation and additional context are limited. Evidence is based on CVE and NVD information. Defenders should verify application usage of HTTP::Headers::ActionPack and versions in use, especially for untrusted HTTP headers. Additional context from vendor sources or security researchers may be necessary for comprehensive risk assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.