Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-62160GHSA-RHJ7-VH3V-MCQ6EUVD-2026-114281

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Daptin versions up to 0.12.15 are listed as affected, and 0.12.26 is the fixed release. The CVSS score is 8.7 (High); no vendor severity rating is given.

Published
Last modified
published
Not listed in CISA KEV
Unclear
Fix
Fixed in 0.12.26
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: poc
  • Automatable: yes
  • Technical impact: partial

Summary

Daptin, an open-source headless CMS that uses GraphQL and JSON-API, is affected through its language-handling middleware, which parses the Accept-Language HTTP header. An unauthenticated attacker can send specially crafted headers to public endpoints such as the landing page or the API to consume a disproportionate amount of server CPU, which can degrade or deny service to legitimate users.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: poc · Automatable: yes · Technical impact: partial

  4. Record last updated

Affected versions

  • daptin daptin

    fixed in 0.12.26

  • github.com/daptin/daptinGo

    through 0.12.15

References 2

GitHub · daptin/daptin

FAQ

Questions about CVE-2026-62160

What does this mean?

A crafted Accept-Language header bypasses the parser's handling of the underscore separator, which multiplies the CPU work done per request by more than 250 times.Source: github.com

Am I affected, and how do I check?

The listed affected range is github.com/daptin/daptin up to and including 0.12.15. The flaw is in LanguageMiddleware, which is registered as a global gin middleware and passes the raw Accept-Language header of every request to the parser, so the installed Daptin version is the thing to check.Source: github.com

What should I do about it?

Upgrade Daptin to version 0.12.26 or later, which is the listed fixed release.Source: github.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data