Hi,

The following vulnerability was published for libhttp-headers-actionpack-perl.

CVE-2026-113877[0]:
| HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU
| exhaustion via Accept-Language ranges matched as regular
| expressions.  _language_match interpolates each Accept-Language
| range into the pattern `/^$range\-/i` without escaping it, so
| regular expression syntax in the header reaches the regex engine. A
| 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and
| each increment of the quantifier doubles the time. An invalid range
| such as `(` fails to compile.  A remote attacker can exhaust CPU, or
| make choose_language die, in any application that passes an
| untrusted Accept-Language header to it.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-113877
https://www.cve.org/CVERecord?id=CVE-2026-113877
[1] https://lists.security.metacpan.org/cve-announce/msg/44584817/
[2] https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libhttp-headers-actionpack-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151877@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libhttp-headers-actionpack-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 24 Oct 2026 14:48:19 +0200
Source: libhttp-headers-actionpack-perl
Architecture: source
Version: 0.10-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1151877
Changes:
 libhttp-headers-actionpack-perl (0.10-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 0.10.
     - Accept-Language headers are checked as substrings, not regular
       expressions. (CVE-2026-113877)
     Closes: #1151877
   * Update debian/upstream/metadata.
   * Install new upstream documents.
   * Update years of upstream copyright.
   * New test dependency: libtest-timer-perl.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Priority: optional», which is the current default.
   * Annotate test-only build dependencies with <!nocheck>.
   * Update watch file format version to 5.
Checksums-Sha1:
 3f7d53d19e643f8302e4c51aca9a5066316ad937 2767 libhttp-headers-actionpack-perl_0.10-1.dsc
 1c8756c1e0c5418f2175c0a8394dd72b8c194f2a 55757 libhttp-headers-actionpack-perl_0.10.orig.tar.gz
 6b72e0ab8767f1d34cb1740db52f4a5f43284912 2668 libhttp-headers-actionpack-perl_0.10-1.debian.tar.xz
 ac4a133e868fb83347c8b0f4ee6e05cc46b33c56 157148 libhttp-headers-actionpack-perl_0.10-1.git.tar.xz
 e4a478c34d2121642ca1af62355a997594281de1 17824 libhttp-headers-actionpack-perl_0.10-1_source.buildinfo
Checksums-Sha256:
 0e965b990cc734d0bb657708b8ff7881548be8e46b347122de04aeb7d301ceb9 2767 libhttp-headers-actionpack-perl_0.10-1.dsc
 64297d4951c2b70599349b356ea9a8f7f73f9367e64ac62db39cf9da20506956 55757 libhttp-headers-actionpack-perl_0.10.orig.tar.gz
 924a48296599a4a52a38c7cae728ce077ad3b9440ad5374135f8deb5504a1221 2668 libhttp-headers-actionpack-perl_0.10-1.debian.tar.xz
 2e61113e2bf0ec96641b43e93d781575822dfa09b588a995726b516adfa1bb36 157148 libhttp-headers-actionpack-perl_0.10-1.git.tar.xz
 99388e9a1eb084c34aee1a201fd289aff848dfe2474c41c506cbf4118dffa7e6 17824 libhttp-headers-actionpack-perl_0.10-1_source.buildinfo
Files:
 5164e30be62ccc7c0f016c8e83f55fad 2767 perl optional libhttp-headers-actionpack-perl_0.10-1.dsc
 306820abac3999bb7ee0a0e9b9c25aec 55757 perl optional libhttp-headers-actionpack-perl_0.10.orig.tar.gz
 87e29ed2587d14af2558fc4d46bcaa40 2668 perl optional libhttp-headers-actionpack-perl_0.10-1.debian.tar.xz
 072d0c71ca6f770de0bcd06079a126e9 157148 perl None libhttp-headers-actionpack-perl_0.10-1.git.tar.xz
 81ba051ded7981294da5f1e3d5f00569 17824 perl optional libhttp-headers-actionpack-perl_0.10-1_source.buildinfo
Git-Tag-Info: tag=ba865fb023a4b1cf031e73837d2056a32f6ace89 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrcqdEACgkQYG0ITkaD
wHl8Rg/+IfarFWOwqUp4wfzz6BLsgtOs+rNaA44tWmwtCuZ0RDaSalD60xoghEYU
kJwOkJJmWd545kd+ISBYhXC7lmAka6f25+QlUwE9cWZzdMjzIDHx6xwWnPsd70cN
93Uv939c7c20b/XhoFiB5KVHghFfvUQ6R0LVd2bn+FYTYw2xp9zYTaQpo6wvlcNG
b/lzcgnuRpQ4/fcv7jxZXbqBsbR388mSpjtHY5Lwn+1Z2IwQQzp9uewqCfY/wBRN
6JRCuCssSsfieRXGf2UlHKPDdM1Pw5BWi2IMTGELeUIH9Pgm29t2XPDVaQRbyadw
05txxXaookzNHv8O1GJ9x29BtBDvrusx1F3IwqJSwCf/9ZvA+VYDtMHa2Xj9j8IH
dDBdI8K7gHKDbmn0nSdyPBCTMyZnyTzlnShKWUvn4/jvbF8AHOUXgN9f87rUc4Yt
93Q0e6/U89lkHm7ZoXnKw6g1znPjNDntRfX8Ws4pi29IoGH8VH7pXwFo8C8oZef5
14+7P0nSZe9MyscagEdIItHXr5BS+r7IrHW4lMtjj/s5AAe3RvX5aXtdJQ5hhEvY
V8UDuQFJxv98jEWDXapp2B3K5nSJCudi+4iJBTx/V1jFg+oek+ji2QTUROPadlS4
zI4mA1MzTszy7PzW8uztvRtqcKkU1xirz02FYDG6/gS7ZXgztAw=
=DqyN
-----END PGP SIGNATURE-----