HTTP::Headers::ActionPack versions before 0.10 for Perl contain a vulnerability where the Accept-Language header is improperly handled, allowing crafted regular expressions to cause CPU exhaustion or application failure. This occurs because the Accept-Language ranges are interpolated directly into a regex pattern without escaping, enabling malicious input to trigger excessive backtracking or regex compilation errors.