높음취약점 권고Go GitHub2026. 10. 30. 오전 01:33

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

影響: go:github.com/daptin/daptin <= 0.12.15

Daptin's LanguageMiddleware (registered as a global gin middleware) calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal s…

GitHub Advisory Database에서 읽기

X에서 속보 받기악용·대형 유출·장애를 대응 방법과 함께.

팔로우 @vulnpulse_app

CVE	CVE-2026-62160
정보원	GitHub Advisory Database
수집 시각	2026. 10. 30. 오전 01:37
데이터	Markdown　JSON

2026. 10. 30. 오전 01:33, GitHub Advisory Database에서 "Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-62160.