lin-snow Ech0 up to 5.0.0 i18n middleware language golang.org/x/text/language.ParseAcceptLanguage Accept-Language denial of service

Summaryinfo

A vulnerability was found in lin-snow Ech0 up to 5.0.0 and classified as problematic. The impacted element is the function golang.org/x/text/language.ParseAcceptLanguage of the file golang.org/x/text/language of the component i18n middleware. The manipulation of the argument Accept-Language results in denial of service. This vulnerability was named CVE-2026-79658. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in lin-snow Ech0 up to 5.0.0. Affected is the function golang.org/x/text/language.ParseAcceptLanguage of the file golang.org/x/text/language of the component i18n middleware. The manipulation of the argument Accept-Language with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-79658 since 08/25/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 5.0.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• lin-snow

Name

• Ech0

Version

• 5.0

Website

• Product: https://github.com/lin-snow/Ech0/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion