{"id":"ghsa-ghsa-rhj7-vh3v-mcq6","seq":2248098,"kind":"advisory","title":"Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware","url":"https://github.com/advisories/GHSA-rhj7-vh3v-mcq6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rhj7-vh3v-mcq6","summary":"影響: go:github.com/daptin/daptin <= 0.12.15\nDaptin's LanguageMiddleware (registered as a global gin middleware) calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal s…","severity":"high","techs":["go","github"],"cves":["CVE-2026-62160"],"tags":["GHSA-rhj7-vh3v-mcq6","github.com/daptin/daptin"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-29T16:33:09.000Z","fetched_at":"2026-10-29T16:37:52.361Z"}