CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436

CVE-2026-58436 describes a quadratic-time DoS in Gitea’s Locale middleware. The unauthenticated request path passes the raw Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input size or token-class filtering, allowing crafted headers to trigger the O(N^2) parser p...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...