Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

影響: go:github.com/daptin/daptin <= 0.12.15

Daptin's LanguageMiddleware (registered as a global gin middleware) calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal s…

在 GitHub Advisory Database 阅读

2026/10/30 01:33，GitHub Advisory Database 发布了“Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。CVE：CVE-2026-62160。