CVE-2026-62160

Daptin's "LanguageMiddleware" registered as a global gin middleware calls "golang.org/x/text/language.ParseAcceptLanguage" on the raw "Accept-Language" header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of...