The vulnerability allows crafted Accept‑Language header values to be interpreted as regular expressions, causing the regex engine to perform extensive backtracking. This can exhaust processor time or trigger a fatal error in the library, leading to a denial of service. The primary impact is loss of availability for applications that process untrusted HTTP headers.

Perl applications that utilize HTTP::Headers::ActionPack versions prior to 0.10 are affected. Any deployment that imports the module and forwards raw Accept‑Language headers to it is susceptible, regardless of whether the application is a web framework, microservice, or custom script.

The vulnerability is remotely exploitable via standard HTTP requests containing malicious Accept‑Language values. Because the header is passed straight into the regex engine without sanitization, an attacker can trigger severe CPU load or crashes with minimal effort. The CVSS score of 7.5 and an EPSS score of < 1% suggest a high exploitation risk. The vulnerability is not listed in CISA KEV. No publicly disclosed exploits are reported, but the nature of the attack vector indicates a high likelihood of exploitation in environments that accept external input.