Vulnerability feed

Executive summary

HTTP::Headers::ActionPack for Perl, before version 0.10, can be forced to use excessive CPU by a crafted Accept-Language header. The advisory says the fix changes language matching so header values are compared as plain text instead of regular expressions. The advisory does not state a severity rating, and the fix is in the code change shown.

Technical summary

The flaw is classed as CPU exhaustion caused by treating Accept-Language range values as unescaped regular expressions, which is a regular expression denial-of-service issue. The advisory states that versions before 0.10 are affected and that the attacker can submit crafted Accept-Language headers, with no authentication described in the text. The patch replaces the regex match in _language_match with a case-insensitive exact, wildcard, or prefix comparison using substr, and adds a timing test. The fixed version is stated as 0.10 in the affected-version line, and the Changes entry is under an unreleased heading, so the released version number is not otherwise stated. No workaround is stated, no CVSS score is stated, and no detection guidance or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/robrwo/perl-HTTP-Headers-Act…2750e0f0f4bec9.patch

Score

No CVSS score published.

Affects

Robert RothenbergRobert Rothenberg HTTP::Headers::ActionPack