CVE-2026-79658: Ech0 before 5.0.1 Denial of Service via Accept-Language
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ech0to a version that resolves this vulnerability.Fixed in 5.0.1 - Configuration
Configure Ech0 (i18n middleware) to impose a size/shape limit on the Accept-Language header and reject oversized inputs that can trigger quadratic-time parsing in language.ParseAcceptLanguage.
Ech0 i18n middleware / Accept-Language processing Accept-Language header size/shape limits = Enforce a size limit and reject unexpected separators such as large underscore-delimited patterns - Compensating control
Apply a compensating control to limit request header sizes/rates (e.g., at a reverse proxy/WAF) to prevent unauthenticated clients from sending large Accept-Language headers that saturate CPU (DoS).
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
Ech0 deployments before 5.0.1 that use the i18n middleware are exposed because that middleware processes the Accept-Language header on every HTTP request. The issue is reachable remotely over HTTP.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker can send a large Accept-Language header using underscore separators to trigger expensive parsing.
What is the practical impact of exploitation?
A crafted request can consume roughly 1.5 seconds of CPU. Concurrent requests can saturate a multi-core server and cause denial of service.
What should be checked when determining exposure?
Check whether the deployment runs a version before 5.0.1 and whether i18n middleware is enabled. Also review whether the service accepts HTTP requests from untrusted clients, since exploitation is unauthenticated.