/ 
perl-5.44.0
⭐ Starred 2013 / I18N::LangTags::Detect
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

I18N::LangTags::Detect - detect the user's language preferences

SYNOPSIS

use I18N::LangTags::Detect;
my @user_wants = I18N::LangTags::Detect::detect();

DESCRIPTION

It is a common problem to want to detect what language(s) the user would prefer output in.

FUNCTIONS

This module defines one public function, I18N::LangTags::Detect::detect(). This function is not exported (nor is even exportable), and it takes no parameters.

In scalar context, the function returns the most preferred language tag (or undef if no preference was seen).

In list context (which is usually what you want), the function returns a (possibly empty) list of language tags representing (best first) what languages the user apparently would accept output in. You will probably want to pass the output of this through I18N::LangTags::implicate_supers_tightly(...) or I18N::LangTags::implicate_supers(...), like so:

my @languages =
  I18N::LangTags::implicate_supers_tightly(
    I18N::LangTags::Detect::detect()
  );

ENVIRONMENT

This module looks at several environment variables: REQUEST_METHOD, HTTP_ACCEPT_LANGUAGE, LANGUAGE, LC_ALL, LC_MESSAGES, and LANG.

It will also use the Win32::Locale module, if it's installed and IGNORE_WIN32_LOCALE is not set to a true value in the environment.

SEE ALSO

I18N::LangTags, Win32::Locale, Locale::Maketext.

(This module's core code started out as a routine in Locale::Maketext; but I moved it here once I realized it was more generally useful.)

COPYRIGHT

Copyright (c) 1998-2004 Sean M. Burke. All rights reserved.

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The programs and documentation in this dist are distributed in the hope that they will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose.

AUTHOR

Sean M. Burke sburke@cpan.org