https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:10:21 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-79658 <p>Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n&#39;s NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps &#39;-&#39; characters but not &#39;_&#39; characters, which the parser aliases to &#39;-&#39;, allowing quadratic-time parsing to be triggered with a large header (up to Go&#39;s default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).</p> <p>Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n&#39;s NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps &#39;-&#39; characters but not &#39;_&#39; characters, which the parser aliases to &#39;-&#39;, allowing quadratic-time parsing to be triggered with a large header (up to Go&#39;s default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-79658 https://vulnerability.circl.lu/vuln/ghsa-j8jc-x8v7-x64g <p>Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n&#39;s NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps &#39;-&#39; characters but not &#39;_&#39; characters, which the parser aliases to &#39;-&#39;, allowing quadratic-time parsing to be triggered with a large header (up to Go&#39;s default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).</p> <p>Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n&#39;s NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps &#39;-&#39; characters but not &#39;_&#39; characters, which the parser aliases to &#39;-&#39;, allowing quadratic-time parsing to be triggered with a large header (up to Go&#39;s default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).</p> https://vulnerability.circl.lu/vuln/ghsa-j8jc-x8v7-x64g