CVE-2026-58436

CVE-2026-58436 describes a quadratic-time DoS in Gitea’s Locale middleware. The unauthenticated request path passes the raw Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input size or token-class filtering, allowing crafted headers to trigger the O(N^2) parser p...

CVE-2026-58436

creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:50+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3...