Denial of Service Vulnerability in nginx Ignition API Server
CVE-2026-61629

7.5HIGH

Key Information:

Vendor

Lucasdillmann

Status
Nginx-ignition
Vendor
CVE Published:
21 September 2026

What is CVE-2026-61629?

A denial of service vulnerability exists in nginx Ignition's API server, where the gin i18n middleware processes the raw 'Accept-Language' header without appropriate size constraints. This oversight can lead to excessive CPU consumption, as malformed language tags can exploit a quadratic-time parsing issue. A single unauthenticated GET request with a maliciously crafted header can drastically increase server load, potentially saturating system resources with concurrent requests. Updating to version 2.40.1 mitigates this risk.

Affected Version(s)

nginx-ignition >= 2.29.0, < 2.40.1

References

https://github.com/lucasdillmann/nginx-ignition/security/...
x_refsource_CONFIRM
https://github.com/lucasdillmann/nginx-ignition/commit/0c...
x_refsource_MISC
https://github.com/lucasdillmann/nginx-ignition/commit/cb...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.