Your message dated Sat, 24 Oct 2026 13:04:53 +0000
with message-id <[email protected]>
and subject line Bug#1151877: fixed in libhttp-headers-actionpack-perl 0.10-1
has caused the Debian Bug report #1151877,
regarding libhttp-headers-actionpack-perl: CVE-2026-113877
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151877: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151877
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libhttp-headers-actionpack-perl
Version: 0.09-4
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for libhttp-headers-actionpack-perl.
CVE-2026-113877[0]:
| HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU
| exhaustion via Accept-Language ranges matched as regular
| expressions. _language_match interpolates each Accept-Language
| range into the pattern `/^$range\-/i` without escaping it, so
| regular expression syntax in the header reaches the regex engine. A
| 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and
| each increment of the quantifier doubles the time. An invalid range
| such as `(` fails to compile. A remote attacker can exhaust CPU, or
| make choose_language die, in any application that passes an
| untrusted Accept-Language header to it.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-113877
https://www.cve.org/CVERecord?id=CVE-2026-113877
[1] https://lists.security.metacpan.org/cve-announce/msg/44584817/
[2]
https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libhttp-headers-actionpack-perl
Source-Version: 0.10-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libhttp-headers-actionpack-perl, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated
libhttp-headers-actionpack-perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 14:48:19 +0200
Source: libhttp-headers-actionpack-perl
Architecture: source
Version: 0.10-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1151877
Changes:
libhttp-headers-actionpack-perl (0.10-1) unstable; urgency=medium
.
* Team upload.
* Import upstream version 0.10.
- Accept-Language headers are checked as substrings, not regular
expressions. (CVE-2026-113877)
Closes: #1151877
* Update debian/upstream/metadata.
* Install new upstream documents.
* Update years of upstream copyright.
* New test dependency: libtest-timer-perl.
* Declare compliance with Debian Policy 4.7.4.
* Remove «Priority: optional», which is the current default.
* Annotate test-only build dependencies with <!nocheck>.
* Update watch file format version to 5.
Checksums-Sha1:
3f7d53d19e643f8302e4c51aca9a5066316ad937 2767
libhttp-headers-actionpack-perl_0.10-1.dsc
1c8756c1e0c5418f2175c0a8394dd72b8c194f2a 55757
libhttp-headers-actionpack-perl_0.10.orig.tar.gz
6b72e0ab8767f1d34cb1740db52f4a5f43284912 2668
libhttp-headers-actionpack-perl_0.10-1.debian.tar.xz
ac4a133e868fb83347c8b0f4ee6e05cc46b33c56 157148
libhttp-headers-actionpack-perl_0.10-1.git.tar.xz
e4a478c34d2121642ca1af62355a997594281de1 17824
libhttp-headers-actionpack-perl_0.10-1_source.buildinfo
Checksums-Sha256:
0e965b990cc734d0bb657708b8ff7881548be8e46b347122de04aeb7d301ceb9 2767
libhttp-headers-actionpack-perl_0.10-1.dsc
64297d4951c2b70599349b356ea9a8f7f73f9367e64ac62db39cf9da20506956 55757
libhttp-headers-actionpack-perl_0.10.orig.tar.gz
924a48296599a4a52a38c7cae728ce077ad3b9440ad5374135f8deb5504a1221 2668
libhttp-headers-actionpack-perl_0.10-1.debian.tar.xz
2e61113e2bf0ec96641b43e93d781575822dfa09b588a995726b516adfa1bb36 157148
libhttp-headers-actionpack-perl_0.10-1.git.tar.xz
99388e9a1eb084c34aee1a201fd289aff848dfe2474c41c506cbf4118dffa7e6 17824
libhttp-headers-actionpack-perl_0.10-1_source.buildinfo
Files:
5164e30be62ccc7c0f016c8e83f55fad 2767 perl optional
libhttp-headers-actionpack-perl_0.10-1.dsc
306820abac3999bb7ee0a0e9b9c25aec 55757 perl optional
libhttp-headers-actionpack-perl_0.10.orig.tar.gz
87e29ed2587d14af2558fc4d46bcaa40 2668 perl optional
libhttp-headers-actionpack-perl_0.10-1.debian.tar.xz
072d0c71ca6f770de0bcd06079a126e9 157148 perl None
libhttp-headers-actionpack-perl_0.10-1.git.tar.xz
81ba051ded7981294da5f1e3d5f00569 17824 perl optional
libhttp-headers-actionpack-perl_0.10-1_source.buildinfo
Git-Tag-Info: tag=ba865fb023a4b1cf031e73837d2056a32f6ace89
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrcqdEACgkQYG0ITkaD
wHl8Rg/+IfarFWOwqUp4wfzz6BLsgtOs+rNaA44tWmwtCuZ0RDaSalD60xoghEYU
kJwOkJJmWd545kd+ISBYhXC7lmAka6f25+QlUwE9cWZzdMjzIDHx6xwWnPsd70cN
93Uv939c7c20b/XhoFiB5KVHghFfvUQ6R0LVd2bn+FYTYw2xp9zYTaQpo6wvlcNG
b/lzcgnuRpQ4/fcv7jxZXbqBsbR388mSpjtHY5Lwn+1Z2IwQQzp9uewqCfY/wBRN
6JRCuCssSsfieRXGf2UlHKPDdM1Pw5BWi2IMTGELeUIH9Pgm29t2XPDVaQRbyadw
05txxXaookzNHv8O1GJ9x29BtBDvrusx1F3IwqJSwCf/9ZvA+VYDtMHa2Xj9j8IH
dDBdI8K7gHKDbmn0nSdyPBCTMyZnyTzlnShKWUvn4/jvbF8AHOUXgN9f87rUc4Yt
93Q0e6/U89lkHm7ZoXnKw6g1znPjNDntRfX8Ws4pi29IoGH8VH7pXwFo8C8oZef5
14+7P0nSZe9MyscagEdIItHXr5BS+r7IrHW4lMtjj/s5AAe3RvX5aXtdJQ5hhEvY
V8UDuQFJxv98jEWDXapp2B3K5nSJCudi+4iJBTx/V1jFg+oek+ji2QTUROPadlS4
zI4mA1MzTszy7PzW8uztvRtqcKkU1xirz02FYDG6/gS7ZXgztAw=
=DqyN
-----END PGP SIGNATURE-----
pgpdG6BWoqouP.pgp
Description: PGP signature
--- End Message ---
