GO-2026-6539
- Source
- https://pkg.go.dev/vuln/GO-2026-6539
- Import Source
- https://vuln.go.dev/ID/GO-2026-6539.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6539
- Aliases
- Published
- 2026-09-28T16:43:40Z
- Modified
- 2026-09-28T17:00:25Z
- Summary
- nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
- Details
-
nginx ignition has ParseAcceptLanguage
_separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition - Database specific
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6539" }- References
-
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-61629
- https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
- https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485
- https://github.com/lucasdillmann/nginx-ignition/pull/125
- https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1
Affected packages
Go / github.com/lucasdillmann/nginx-ignition
Package
- Name
- github.com/lucasdillmann/nginx-ignition
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/lucasdillmann/nginx-ignition