重要脆弱性アドバイザリGo GitHub2026/10/30 01:33

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

影響: go:github.com/daptin/daptin <= 0.12.15

Daptin's LanguageMiddleware (registered as a global gin middleware) calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal s…

GitHub Advisory Databaseで読む

X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。

フォロー @vulnpulse_app

CVE	CVE-2026-62160
情報源	GitHub Advisory Database
取得日時	2026/10/30 01:37
データ	Markdown　JSON

2026/10/30 01:33、GitHub Advisory Databaseが「Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Go、GitHub。CVE: CVE-2026-62160。