## Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-62160
- 公開日時: 2026-10-29T16:33:09.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-rhj7-vh3v-mcq6)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-rhj7-vh3v-mcq6

影響: go:github.com/daptin/daptin <= 0.12.15
Daptin's LanguageMiddleware (registered as a global gin middleware) calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal s…