CVE-2026-62160
Received Received - Intake

Denial-of-Service via Accept-Language Header in Daptin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-62160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
daptin daptin < 0.12.26

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Daptin is a headless CMS vulnerable to a denial-of-service attack via crafted Accept-Language headers. The issue occurs in the LanguageMiddleware where raw headers are passed to a parser without proper filtering. Underscore-separated language tags longer than eight characters bypass security checks, causing excessive CPU usage through repeated buffer operations. This leads to slow processing and potential server saturation.

Detection Guidance

Monitor CPU usage spikes during HTTP requests with large Accept-Language headers containing many underscore-separated language tags. Check for slow responses or timeouts when accessing the public landing page or /api endpoint. Use tools like curl to send test requests with malformed headers and observe server behavior.

Impact Analysis

Unauthenticated attackers can send specially crafted HTTP requests with large Accept-Language headers to consume disproportionate CPU resources. This may cause the server to slow down or become unresponsive, disrupting normal operations. Repeated exploitation could lead to a denial-of-service condition.

Mitigation Strategies

Upgrade Daptin to version 0.12.26 or later to address the vulnerability. Implement rate limiting on HTTP headers to prevent abuse. Monitor and restrict header sizes to a reasonable limit (e.g., 256 KiB). Disable verbose logging of invalid headers to reduce amplification of CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62160. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart