LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

CVE-2020-27223

CVE-2020-27223 Using $ mvn spring-boot:run 9.4.36.v20210114 $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s 9.4.37.v20210219 Fixed $...

CLEANSTART-2026-ON13677 attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details...

CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global "LanguageMiddleware" in "server/language.go" passes the raw "Accept-Language" header from "LanguageMiddlewareFunc" through "GetLanguagePreference" to "golang.org/x/text/language.ParseAcceptLanguage" without a size or shape...

CVE-2026-62160

Daptin , a GraphQL/JSON-API headless CMS, is vulnerable to a Denial of Service (DoS) attack via CPU amplification in its LanguageMiddleware. The issue occurs because the middleware passes the raw Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without sufficient size or s...

EUVD-2026-114281

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

CVE-2026-62160 Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

CVE-2026-62160 Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

CVE-2026-62160: daptin: Daptin is a GraphQL/JSON-API headless CMS

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Summary Daptin's LanguageMiddleware registered as a global gin middleware calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of...

GHSA-RHJ7-VH3V-MCQ6 Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Summary Daptin's LanguageMiddleware registered as a global gin middleware calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of...

CVE-2026-113877

A flaw was found in HTTP::Headers::ActionPack. A remote attacker can trigger a Denial of Service DoS by sending an HTTP request with a crafted Accept-Language header to an affected application. Because language range values are evaluated as regular expression patterns without proper sanitization,...

SUSE CVE-2026-113877

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolates each Accept-Language range into the pattern /^$range-/i without escaping it, so regular expression syntax in the header reaches the...

EUVD-2026-110508

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

CVE-2026-116800

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

World Wide Broadcast Network AVideo path traversal vulnerability

Versions prior to AVideo 29.5.0 of the World Wide Broadcast Network contain a path traversal vulnerability stemming from local file inclusion issues. Unauthenticated attackers can exploit this by including PHP files outside the locale directory via a specially crafted Accept-Language header, then...

CVE-2026-116800 WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

CVE-2026-116800

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

CVE-2026-116800

WWBN AVideo versions before 29.5.0 are vulnerable to a Local PHP File Inclusion vulnerability. An unauthenticated attacker can exploit a flaw in the setLanguage() function by providing a crafted Accept-Language header using overlapping traversal sequences like ....// . This allows the attacker to...