Quick answers
- Is CVE-2026-113877 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-113877 being exploited in the wild.
- How severe is CVE-2026-113877?
- Informational severity, published 23 October 2026.
- Which products and versions are affected?
- CPAN HTTP::Headers::ActionPack before 0.10.
- Is there a fix for CVE-2026-113877?
- Yes: fixed in 0.10. Until then: Restrict or validate Accept-Language headers at the web server or reverse proxy level to reject those containing special regex characters before they reach the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-113877 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-113877?
- Check whether you run CPAN HTTP::Headers::ActionPack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.10
Restrict or validate Accept-Language headers at the web server or reverse proxy level to reject those containing special regex characters before they reach the application.
Technical details
The _language_match subroutine constructs a regular expression by interpolating an unescaped Accept-Language range directly into the pattern `/^$range\-/i`, allowing regex metacharacters in the header to reach the regex engine. An attacker can exploit catastrophic backtracking with patterns like `(a?|b?){26}z`, causing exponential CPU consumption or compilation failures with malformed patterns like `(`.
Affected products
- CPAN HTTP::Headers::ActionPack before 0.10
Timeline
- 2026-10-23: disclosed