CVE-2026-62160

Name of the Vulnerable Software and Affected Versions github.com/daptin/daptin versions 0.12.x and earlier

Description An unauthenticated user can cause a Denial of Service (DoS) by sending a specially crafted HTTP request. The LanguageMiddleware (registered as a global gin middleware) processes the Accept-Language header using language.ParseAcceptLanguage without imposing size or character filters. While a guard exists to limit the number of - characters, it does not account for characters, which the internal scanner aliases to - before parsing.

An attacker can bypass this guard by using separators in a long list of malformed language tags, triggering quadratic-time behavior in the parser. For example, a 256 KiB payload can consume approximately 27 seconds of server CPU, and a 1 MiB payload can exceed 120 seconds. This allows a single attacker with limited bandwidth to pin server CPU cores indefinitely. The issue is further amplified by the GetLanguagePreference() function and the resource.CheckErr() call, which formats the entire malicious input into a log line upon failure.

Recommendations Implement a size or character-class filter within LanguageMiddlewareFunc() and GetLanguagePreference() to count both - and separators, short-circuiting the process if the total exceeds a reasonable limit (e.g., 32) before calling language.ParseAcceptLanguage.