https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:39:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-79658 <p><strong>Affected:</strong> lin-snow Ech0</p> <p>Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n&#39;s NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps &#39;-&#39; characters but not &#39;_&#39; characters, which the parser aliases to &#39;-&#39;, allowing quadratic-time parsing to be triggered with a large header (up to Go&#39;s default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).</p> <p><strong>Affected:</strong> lin-snow Ech0</p> <p>Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n&#39;s NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps &#39;-&#39; characters but not &#39;_&#39; characters, which the parser aliases to &#39;-&#39;, allowing quadratic-time parsing to be triggered with a large header (up to Go&#39;s default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).</p> https://cve.radiocsirt.org/vuln/cve-2026-79658