- Yama var
- Son 7 gün
- CWE-400
- CWE-407
CVE-2026-62160
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
- Yayımlandı
- Güncellendi
- 30 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the len <= 8 length check in golang.org/x/text/internal/language/parse.go, causing repeated gobble operations to move the entire remaining buffer through runtime.memmove. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or /api can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. resource.CheckErr also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| daptin | < 0.12.26 | 0.12.26 |
Kaynaklar4 kaynak
Kayıt geçmişi
- Yayımlandı