CVE-2026-58436
published 2026-08-13CVE-2026-58436: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.34%
26.6th percentile
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-opc-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-cli-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ghsa·2026-07-21·CVSS 7.5
CVE-2026-58436 [HIGH] CWE-1333 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
### Summary
The Locale middleware that runs in front of every unauthenticated request
calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw
`Accept-Language` header without imposing a size or shape filter. The
underlying parser has quadratic-time behaviour on long lists of malformed
language tags. The CVE-2022-32149 guard that golang.org/x/text added in
v0.3.8 caps the number of `-` characters in the input at 1000, but it does
not cap `_` characters even though the parser's internal scanner aliases
`_` to `-` before parsing. A single unauthenticated GET request with an
`Accept-Language` header built out of `_` separators burns ~2 seconds of
server CPU on the host running Gitea; ten
Red Hat
code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
vendor_redhat·2026-08-13·CVSS 7.5
CVE-2026-58436 [HIGH] CWE-1333 code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumption and a Denial of Service (DoS) condition, making the service unavailable to legitimate users.
Statement: This is an Important denial of service vulnerability in Gitea. An unauthenticated remote attacker can exploit a quadratic-time algorithm in the ParseAcceptLanguage function, leading to
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58436 code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
bugzilla·2026-08-13·CVSS 7.5
CVE-2026-58436 [HIGH] CVE-2026-58436 code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
CVE-2026-58436 code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Bugzilla
CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
bugzilla·2025-11-20·CVSS 5.5
CVE-2025-58436 [MEDIUM] CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
A client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable
by other clients.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:0312 https://access.redhat.com/errata/RHSA-2026:0312
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:0464 https://access.redhat.com/errata/RHSA-2026:0464
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:0596 https://access.redhat.com/errata/RHSA-2026:0596
2026-08-13
Published