ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-62160

Daptin: ParseAcceptLanguage separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · Daptin: ParseAcceptLanguage separator bypass

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-62160. EPSS is 0.42%. Act only if a listed version of Daptin: ParseAcceptLanguage separator bypass is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Daptin: ParseAcceptLanguage separator bypass).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.42%
Remediation
Version ranges on file
Affected products
Go github.com/daptin/daptin · go github.com/daptin/daptin · golang github.com

### Summary Daptin's (registered as a global gin middleware) calls on the raw header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of characters in the input at 1000, but it does not cap characters even though the parser's internal scanner aliases to before parsing. A single unauthenticated GET request with an header built out of separators (only 256 KiB, not even the 1 MiB ceiling) consumes about 27 seconds of server CPU on the host running Daptin. A 1 MiB payload exceeds the 2-minute test client timeout. A single attacker on a 1 Mbit/s uplink can pin an entire Daptin host with one request every 30 seconds. ### Affected versions v0.12.15 and (per code inspection of ) all earlier 0.12.x versions that wire on the global gin router without imposing their own size limit on . Verified on: - the official release binary v0.12.15 built into a Docker image from the project's own (E2E below) - at commit by reading (the middleware is unchanged) ### Privilege required Unauthenticated. The middleware is registered on the global gin router that serves both the public landing page and the unauthenticated style endpoints. Anyone who can reach the HTTP listener (port 8080 by default) is in scope. ### Vulnerable code [ ](https://github.com/daptin/daptin/blob/b021ac4ae1f72b7401e851fcf883bc970303c794/server/language.go) (blob SHA ): is the unfiltered HTTP header. Go's default is = 1 MiB and Daptin does not override it, so the parser is allowed to receive up to a megabyte of attacker-controlled data. The call on the error path also formats the entire input string into a log line ( ), amplifying the cost on attacker-supplied 256 KiB-1 MiB payloads. CVE-2022-32149 hardened by counting characters and rejecting inputs with more than 1000 of them. The guard does not count characters even though the sca

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/daptin/daptin0 → 0.12.15
  • go github.com/daptin/daptin<= 0.12.15
  • golang github.comversion unspecified

How to fix CVE-2026-62160

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-62160. EPSS is 0.42%. Act only if a listed version of Daptin: ParseAcceptLanguage separator bypass is installed.

Which versions are affected?

Compare what you have installed with 0 → 0.12.15, <= 0.12.15. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption. EPSS 0.42%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · Go Vulnerability Database

    Detected

    ### Summary Daptin's (registered as a global gin middleware) calls on the raw header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of characters in the input at 1000, but it does not cap characters even thoug

  2. Oct 29, 2026 · Go Vulnerability Database

    Fix available

    github.com/daptin/daptin fixed in 0.12.15

  3. Oct 29, 2026 · Go Vulnerability Database

    Updated

    ### Summary Daptin's (registered as a global gin middleware) calls on the raw header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of characters in the input at 1000, but it does not cap characters even thoug

Sources

  • CVE.orgVulnerability recordCVE-2026-62160

    CVE.org record is not available yet.

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-62160

    30-day exploitation probability 0.42%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-rhj7-vh3v-mcq6

    Daptin: ParseAcceptLanguage separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-62160

    Daptin's LanguageMiddleware (registered as a global gin middleware) calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - ch

    advisories.gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-rhj7-vh3v-mcq6

    Daptin: ParseAcceptLanguage separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-rhj7-vh3v-mcq6

    Daptin: ParseAcceptLanguage separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

    osv.dev

References

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • FIRST EPSSOct 31, 2026
  • Go Vulnerability DatabaseOct 31, 2026
  • GitHub Advisory DatabaseOct 30, 2026
  • OpenSSF OSV / OSV ScannerOct 30, 2026
  • CVE.orgOct 29, 2026