HIGH GitHub
CVE-2026-62160
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
### Summary
Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though t
Affected Products
- go/github.com/daptin/daptin <= 0.12.15
References
- https://github.com/advisories/GHSA-rhj7-vh3v-mcq6
- https://github.com/daptin/daptin/security/advisories/GHSA-rhj7-vh3v-mcq6
- https://github.com/advisories/GHSA-rhj7-vh3v-mcq6
This high severity vulnerability was published on 2026-10-29 via GitHub. Affected: go/github.com/daptin/daptin <= 0.12.15.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.