CVE-2026-61629 in nginx-ignition
Summary
by MITRE • 09/21/2026
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in nginx ignition, specifically within versions ranging from 2.29.0 to 2.40.0, represents a significant denial-of-service risk stemming from inefficient input validation and parsing logic. Nginx ignition serves as a user interface for the nginx web server, relying on an API server that processes incoming HTTP requests through various middleware components. Among these is the gin i18n middleware, which is designed to handle internationalization by interpreting language preferences sent by clients. This middleware operates in front of every HTTP request and invokes the `golang.org/x/text/language.ParseAcceptLanguage` function from the golang.org/x/text library to parse the raw Accept-Language header provided by the client. The critical flaw lies in the absence of any size or shape filters applied to this input before it reaches the parser, allowing attackers to supply arbitrarily long and malformed language tags that trigger pathological performance characteristics within the underlying parsing engine.
The technical core of this vulnerability is a quadratic-time complexity behavior inherent in the `ParseAcceptLanguage` function when processing lists of malformed language tags. While the Go standard library team addressed similar issues with CVE-2022-32149 by introducing safeguards that cap the number of hyphen characters at 1000, this fix was incomplete regarding other separator characters. The internal scanner within the parser aliases underscore characters to hyphens before parsing begins. Consequently, an attacker can bypass the hyphen-based limit by using underscores as separators in the Accept-Language header. This oversight allows a single unauthenticated GET request containing a carefully constructed string of underscore-separated language tags to consume approximately 2.4 seconds of CPU time on the host running nginx ignition. The quadratic nature of the algorithm means that performance degrades rapidly as input length increases, turning what should be a lightweight parsing operation into a resource-intensive process.
The operational impact of this vulnerability is severe, particularly in environments where nginx ignition is exposed to untrusted networks or public internet access. A single attacker can cause noticeable latency and CPU spikes on the server. However, when scaled through concurrent requests from multiple attackers, the effect becomes catastrophic. For instance, ten concurrent attackers targeting a ten-core machine can fully saturate all available CPU cores for the duration of their attack sessions. This saturation effectively renders the service unavailable to legitimate users, constituting a classic denial-of-service scenario. Additionally, the attack generates significant network traffic, consuming approximately 10 MiB/s of upstream bandwidth per attacker due to the large size of the malicious headers required to trigger the quadratic behavior efficiently.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and specifically relates to inefficient regular expression or parsing logic that leads to excessive CPU usage. In terms of the MITRE ATT&CK framework, this exploit maps to T1499: Endpoint Denial of Service, as it involves overwhelming a system's resources through sustained computational demand rather than crashing the application outright. The lack of input sanitization also touches upon CWE-20: Improper Input Validation, as the middleware fails to enforce constraints on the structure and length of incoming data before processing.
To mitigate this vulnerability, organizations running nginx ignition versions 2.29.0 through 2.40.0 must upgrade immediately to version 2.40.1 or later, where the issue has been resolved by properly handling separator characters in the parsing logic. For systems that cannot be patched instantly, implementing a Web Application Firewall rule to limit the length of the Accept-Language header is recommended as an interim measure. Additionally, configuring rate limiting on the API server can help mitigate the impact of concurrent attacks by restricting the number of requests from a single source IP address within a given time window. These steps will restore service availability and prevent resource exhaustion caused by malformed input data.