CVE-2026-79658
Received Received - Intake

ReDoS via Accept-Language Header in Ech0

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79658
EUVD
EUVD-2026-65456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lin-snow ech0 to 5.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79658 is a denial of service vulnerability in Ech0's i18n middleware. It occurs because the Accept-Language HTTP header is passed unfiltered to a Go language parser that has quadratic-time complexity when processing malformed language tags. Attackers can exploit this by sending large headers with many underscore-separated tokens, which the parser converts to hyphens, triggering excessive CPU usage.

Detection Guidance

Monitor HTTP requests for unusually large Accept-Language headers containing many underscores. Use tools like tcpdump or Wireshark to capture and inspect headers for patterns like repeated underscores in the Accept-Language field. Check server logs for requests with headers exceeding typical sizes (e.g., >1KB).

Commands to detect: 1) tcpdump -i any -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'Accept-Language:' 2) tail -f /var/log/nginx/access.log | grep -i 'accept-language.*_.*_'

Impact Analysis

An unauthenticated attacker can send specially crafted requests to consume significant CPU resources, potentially saturating servers with multiple cores. A single 1 MiB request may use 1.5 seconds of CPU time, and ten concurrent attackers can overload a 10-core system indefinitely, leading to degraded performance or complete denial of service.

Compliance Impact

This vulnerability primarily causes a denial of service by consuming excessive CPU resources, which could lead to system unavailability. While it does not directly violate GDPR or HIPAA, prolonged downtime may impact data processing obligations under these regulations, potentially leading to compliance failures if critical systems are affected.

Mitigation Strategies

Upgrade Ech0 to version 5.0.1 or later. If upgrading is not immediately possible, implement a middleware filter to sanitize the Accept-Language header by counting and rejecting headers with excessive separators (hyphens or underscores, e.g., >32).

Apply rate limiting to HTTP requests. Block or throttle requests with malformed or oversized Accept-Language headers. Monitor CPU usage spikes and block offending IPs temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart