CVE-2026-61629
Received Received - Intake

Denial of Service in nginx-ignition via Accept-Language Header

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61629
EUVD
EUVD-2026-83924

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nginx ignition From 2.29.0 (inc) to 2.40.0 (inc)
nginx ignition 2.40.1
lucasdillmann nginx-ignition From 2.29.0 (inc) to 2.40.0 (inc)
lucasdillmann nginx-ignition 2.40.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61629 is a high-severity vulnerability in nginx-ignition versions 2.29.0 to 2.40.0. It allows a CPU amplification attack via the Accept-Language header in the i18nMiddleware. The middleware passes the raw header to Go's language parser without filtering, which has quadratic-time behavior on malformed tags. Attackers can exploit this by sending headers with excessive underscores (_), bypassing existing guards and causing severe CPU exhaustion.

Detection Guidance

Monitor CPU usage spikes during HTTP requests with Accept-Language headers containing many underscores. Check nginx-ignition logs for requests with unusually long Accept-Language headers. Use tools like Wireshark to inspect HTTP headers for malformed Accept-Language values.

Impact Analysis

This vulnerability enables unauthenticated denial-of-service attacks. A single malicious request can consume ~2.4 seconds of CPU time. Ten concurrent attackers can saturate a 10-core server indefinitely while using ~10 MiB/s of bandwidth. It affects all unauthenticated endpoints, including root and /api/health, due to the middleware running before route resolution.

Compliance Impact

This vulnerability primarily causes CPU exhaustion via denial-of-service attacks, which could disrupt system availability. For GDPR, availability is a key principle under Article 5, so prolonged outages may violate compliance. HIPAA requires safeguards against unauthorized access or disruption, which this attack enables. However, direct data breaches are not described in the provided context.

Mitigation Strategies

Upgrade nginx-ignition to version 2.40.1 or later. Implement a web application firewall (WAF) to block requests with excessively long Accept-Language headers. Add rate limiting to prevent abuse of the i18n middleware.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart