Vulnerabilidad · Publicado 25/08/2026
Ech0 versiones anteriores a 5.0.1 no valida el tamaño ni estructura del encabezado Accept-Language, permitiendo que solicitudes malformadas causen agotamiento de recursos en el middleware i18n. La vulnerabilidad explota una bypass parcial de CVE-2022-32149 en la librería golang.org/x/text, afectando aplicaciones Go que procesan solicitudes HTTP desde internet público o redes no confiables.
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400
Publicado en NIST NVD.