Denial of Service Vulnerability in Ech0 Middleware by Lin Snow

CVE-2026-79658

What is CVE-2026-79658?

The Ech0 middleware prior to version 5.0.1 is susceptible to a Denial of Service attack due to improper handling of the Accept-Language header. An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, leading to potential exhaustion of server resources. The issue arises from unregulated size and shape limits on the header, allowing attackers to create excessive CPU load on multi-core servers, significantly affecting performance. This vulnerability stems from the lack of filtering when passing the header to the go-i18n library, which does not effectively limit the content it processes.

References