CVE-2026-58436

A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumptio...

CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436

CVE-2026-58436 describes a quadratic-time DoS in Gitea related to parsing the Accept-Language header via the Locale middleware, affecting unauthenticated requests. The available connected sources (NVD, CVE lists, OSV entries, and CIRCL sighting) consistently state the issue as a parsing-based DoS...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

GO-2026-6055 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests in gitea.dev

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests in gitea.dev...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Locale middleware when processing unauthenticated HTTP requests containing a specially crafted Accept-Language header. An attacker can exhaust server CPU resources by sending large...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Locale middleware when processing unauthenticated HTTP requests containing a specially crafted Accept-Language header. An attacker can exhaust server CPU resources by sending large...

GHSA-FW57-JGCH-PGF3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...

PT-2026-63302

Name of the Vulnerable Software and Affected Versions code.gitea.io/gitea versions 1.22.x through 1.26.x Description The Locale middleware, which processes every unauthenticated request, is susceptible to a Denial of Service DoS attack. The issue occurs when the middleware calls...