CVE-2026-58436

CVE-2026-58436 describes a quadratic-time DoS in Gitea’s Locale middleware. The unauthenticated request path passes the raw Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input size or token-class filtering, allowing crafted headers to trigger the O(N^2) parser p...