CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.

• CWE-400
• CWE-407

• https://github.com/daptin/daptin/commit/2d70950979b51eb6c8b4234dd50558b608ad2ffe
• https://github.com/daptin/daptin/security/advisories/GHSA-rhj7-vh3v-mcq6
• https://github.com/daptin/daptin/security/advisories/GHSA-rhj7-vh3v-mcq6

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62144An authentication bypass vulnerability in Check Point Securi…9.1
• CVE-2026-62145A vulnerability in Check Point Gaia Portal allows an authent…7.5
• CVE-2026-62146A trust-boundary flaw in CRI-O's sandbox state persistence a…7.8
• CVE-2026-62147The Tempo Operator's gateway component failed to consistentl…6.5
• CVE-2026-6215A weakness has been identified in DbGate up to 7.1.4. The im…6.3
• CVE-2026-6216A security vulnerability has been detected in DbGate up to 7…3.5
• CVE-2026-62162Hydra is a layer-two scalability solution for Cardano. Prior…8.2
• CVE-2026-62163Rejected reason: Reason: This candidate is a duplicate of CV…
• CVE-2026-62164Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62165Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62166Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-62167Rejected reason: This CVE is a duplicate of another CVE.