SZB-389b5ebc3b
EUVD-2026-114281 reports unsafe Accept-Language parsing in Daptin before 0.12.26
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Daptin
- Product
- Daptin
- First seen
Summary
The EUVD listing says that before version 0.12.26, Daptin's global LanguageMiddleware passes the raw Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without validation. It assigns a CVSS v3.1 score of 8.7.
If you use Daptin
Upgrade Daptin to version 0.12.26 or later
Place a reverse proxy in front of Daptin that limits or normalizes Accept-Language headers until patched
Review logs for unusually long Accept-Language headers
What the sources say 1
· Mastodon: “Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcc...” Source