CVE-2026-58436
Received Received - Intake

ParseAcceptLanguage DoS in Locale Middleware

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58436
EUVD
EUVD-2026-58163

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitea gitea to 1.26.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58436 is a denial-of-service (DoS) vulnerability in Gitea's Locale middleware. It occurs when processing the Accept-Language HTTP header with malformed language tags containing many underscores. The parser converts underscores to hyphens and exhibits quadratic-time complexity, causing high CPU usage.

Detection Guidance

Monitor for unusually high CPU usage on your Gitea server, especially during unauthenticated requests. Check HTTP headers for Accept-Language fields containing excessive underscores (_). Use tools like tcpdump or Wireshark to capture and analyze incoming requests for malformed headers.

Impact Analysis

An unauthenticated attacker can send crafted requests to consume excessive server CPU, potentially leading to system slowdowns or crashes. Ten concurrent attackers could saturate a 10-core system indefinitely while using minimal bandwidth.

Mitigation Strategies

Upgrade Gitea to a version that includes the fix for CVE-2026-58436. Implement rate limiting on HTTP headers, particularly Accept-Language. Add a web application firewall (WAF) rule to block requests with Accept-Language headers exceeding a reasonable length, such as 100 characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart