← Back to the live CVE advisory feed

CVE-2026-79658: Product identification pending

Severity

8.7 (HIGH)

Affected versions

Before 5.0.1

Fixed version

5.0.1

Patch status

Patched

Published

2026-08-25T12:16:29.123

Modified

2026-08-25T12:16:29.123

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

View the official NVD record for CVE-2026-79658

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.