The vulnerability allows crafted Accept‑Language header values to be interpreted as regular expressions, causing the regex engine to perform extensive backtracking. This can exhaust processor time or trigger a fatal error in the library, leading to a denial of service. The primary impact is loss of availability for applications that process untrusted HTTP headers.

Perl applications that utilize HTTP::Headers::ActionPack versions prior to 0.10 are affected. Any deployment that imports the module and forwards raw Accept‑Language headers to it is susceptible, regardless of whether the application is a web framework, microservice, or custom script.

The vulnerability is remotely exploitable via standard HTTP requests containing malicious Accept‑Language values. Because the header is passed straight into the regex engine without sanitization, an attacker can trigger severe CPU load or crashes with minimal effort. No publicly disclosed exploits or KEV status are reported, but the lack of an EPSS score and the nature of the attack vector indicate a high likelihood of exploitation in environments that accept external input.