CVE-2026-113877: Affected product not specified by the source

Affected technology

Product not specified by the source · 0 to before 0.10
Vendor not specified by the source

Description’s affected range: versions before 0.10 for Perl

Component: HTTP::Headers::ActionPack
Function: HTTP::Headers::ActionPack::ContentNegotiation::_language_match, HTTP::Headers::ActionPack::ContentNegotiation::choose_language
File: lib/HTTP/Headers/ActionPack/ContentNegotiation.pm

What an attacker can do

A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.