CVE-2026-79658

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

• CWE-400

• https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc
• https://www.vulncheck.com/advisories/ech0-before-denial-of-service-via-accept-language

Published

Aug 25, 2026

Last Modified

Aug 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79651A flaw was found in the theme localization endpoints of the …7.5
• CVE-2026-79652A flaw was found in the JWT Bearer authorization grant imple…5.9
• CVE-2026-79653In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20…6
• CVE-2026-79654A flaw was found in Katello where the Content View History A…4.3
• CVE-2026-79655A flaw was found in sos clean, a utility within the sos pack…7.8
• CVE-2026-79657NLTK versions before 3.10.3 contain a remote code execution …9.8
• CVE-2026-79659Ech0 before 4.7.3 contains a server-side request forgery vul…7.7
• CVE-2026-7966Insufficient validation of untrusted input in SiteIsolation …3.1
• CVE-2026-79660Ech0 versions before 4.7.3 expose guest commenter email addr…5.3
• CVE-2026-79661Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endp…6.5
• CVE-2026-79662Ech0 through 4.5.6 contains an OAuth redirect URI validation…8
• CVE-2026-79663Ech0 before 4.7.3 contains a stored cross-site scripting vul…4.8