# CVE-2026-113877: HTTP::Headers::ActionPack ReDoS in Accept-Language matching

Source: https://junglewise.ai/threats/cve-2026-113877-http-headers-actionpack-versions-before-0-10-for-perl-allow-cpu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-113877 · Severity: info · Published 2026-10-23

HTTP::Headers::ActionPack is a Perl library used to parse and negotiate HTTP headers in web applications. Versions before 0.10 allow remote attackers to exhaust CPU resources or crash the application by sending a crafted Accept-Language header containing regex syntax, achieving denial of service against any web service using this library.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-113877 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113877 being exploited in the wild.

**How severe is CVE-2026-113877?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** CPAN HTTP::Headers::ActionPack before 0.10.

**Is there a fix for CVE-2026-113877?** Yes: fixed in 0.10. Until then: Restrict or validate Accept-Language headers at the web server or reverse proxy level to reject those containing special regex characters before they reach the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113877 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113877?** Check whether you run CPAN HTTP::Headers::ActionPack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.10

Restrict or validate Accept-Language headers at the web server or reverse proxy level to reject those containing special regex characters before they reach the application.

## Technical details

The _language_match subroutine constructs a regular expression by interpolating an unescaped Accept-Language range directly into the pattern `/^$range\-/i`, allowing regex metacharacters in the header to reach the regex engine. An attacker can exploit catastrophic backtracking with patterns like `(a?|b?){26}z`, causing exponential CPU consumption or compilation failures with malformed patterns like `(`.

## Affected products

- CPAN HTTP::Headers::ActionPack before 0.10

## Timeline

- 2026-10-23: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch](https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch)