CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

CVE-2026-62160 Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...

CVE-2026-62160

Daptin , a GraphQL/JSON-API headless CMS, is vulnerable to a Denial of Service (DoS) attack via CPU amplification in its LanguageMiddleware. The issue occurs because the middleware passes the raw Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without sufficient size or s...

CVE-2026-62160: daptin: Daptin is a GraphQL/JSON-API headless CMS

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global LanguageMiddleware in server/language.go passes the raw Accept-Language header from LanguageMiddlewareFunc through GetLanguagePreference to golang.org/x/text/language.ParseAcceptLanguage without a size or shape filter. The...