CVE-2026-113877

Name of the Vulnerable Software and Affected Versions HTTP::Headers::ActionPack versions prior to 0.10

Description An issue exists where the language match function interpolates each Accept-Language range into a regular expression pattern /^$range-/i without proper escaping. This allows regular expression syntax within the header to reach the regex engine. A remote attacker can provide a specially crafted Accept-Language header, such as (a?|b?){26}z, to cause excessive backtracking, leading to CPU exhaustion or causing the choose language() function to fail. An invalid range, such as (, can cause the compilation to fail.

Recommendations Update HTTP::Headers::ActionPack to version 0.10 or later.