CVE-2026-113877: CWE-624 Executable Regular Expression Error

The vulnerability in HTTP::Headers::ActionPack (versions before 0.10) arises from the _language_match function interpolating Accept-Language header ranges directly into the regex pattern /^$range\-/i without escaping special characters. This allows an attacker to supply maliciously crafted Accept-Language headers containing complex or invalid regex syntax. For example, a 12-byte range like (a?|b?){26}z causes exponential backtracking, resulting in CPU exhaustion. An invalid range such as '(' causes the regex compilation to fail, potentially crashing the choose_language function. This flaw enables remote attackers to exhaust CPU resources or cause application errors by sending specially crafted HTTP headers.

Remote attackers can cause denial of service conditions by exhausting CPU resources through crafted Accept-Language headers that trigger excessive regex backtracking or cause regex compilation failures. This affects any application using vulnerable versions of HTTP::Headers::ActionPack that pass untrusted Accept-Language headers to the _language_match function. There is no indication of code execution or data leakage, but service availability can be impacted.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should avoid passing untrusted Accept-Language headers directly to HTTP::Headers::ActionPack or implement input validation and sanitization to prevent malicious regex patterns. Monitoring for unusual CPU usage related to HTTP requests may help detect exploitation attempts.