CVE-2026-79658: Ech0 i18n Middleware DOS Vulnerability

CVE-2026-79658 Overview

CVE-2026-79658 is a denial-of-service vulnerability in Ech0 before version 5.0.1. The application's i18n middleware processes the Accept-Language header on every HTTP request without enforcing size or shape limits. The header is forwarded unfiltered to go-i18n's NewLocalizer, which calls golang.org/x/text/language.ParseAcceptLanguage. An unauthenticated attacker can submit a large header built from underscore separators to trigger quadratic-time parsing. Each request consumes roughly 1.5 seconds of CPU, and concurrent requests saturate multi-core servers. The weakness is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can exhaust CPU resources on Ech0 servers by sending crafted Accept-Language headers, resulting in denial of service.

Affected Products

Ech0 versions prior to 5.0.1
Applications embedding go-i18n with unbounded Accept-Language input
Deployments relying on golang.org/x/text/language.ParseAcceptLanguage without header size limits

Discovery Timeline

2026-08-25 - CVE-2026-79658 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79658

Vulnerability Analysis

Ech0's internationalization middleware runs on every inbound HTTP request. The middleware reads the Accept-Language header and passes it to go-i18n's NewLocalizer without validation. NewLocalizer invokes golang.org/x/text/language.ParseAcceptLanguage from the golang.org/x/text module. Parsing a large header with pathological structure exhibits quadratic time complexity relative to input length. A single request can occupy a CPU core for approximately 1.5 seconds. Concurrent requests scale linearly, saturating all cores on a multi-core host and blocking legitimate traffic.

Root Cause

The root cause is an algorithmic complexity flaw in ParseAcceptLanguage. The prior mitigation for CVE-2022-32149 in golang.org/x/text capped the count of - (hyphen) characters processed. That mitigation did not cap _ (underscore) characters, which the parser aliases to - after the length check. Attackers can build a header composed of underscore separators up to Go's default 1 MiB header limit. The parser then performs quadratic work on the aliased input. Ech0 compounds the issue by neither bounding the header length nor rejecting malformed language tags before invoking the parser.

Attack Vector

The attack requires no authentication and no user interaction. An attacker sends an HTTP request to any Ech0 endpoint with an oversized Accept-Language header containing underscore-separated language subtags. The i18n middleware fires on the request and enters the quadratic parsing path. Repeating this request in parallel exhausts server CPU capacity. The vulnerability is reachable over the network against any exposed Ech0 instance.

See the GitHub Security Advisory and the VulnCheck Advisory on Ech0 for technical details.

Detection Methods for CVE-2026-79658

Indicators of Compromise

Inbound HTTP requests carrying Accept-Language headers exceeding a few kilobytes, particularly with repeated _ characters.
Sustained CPU saturation on Ech0 worker processes without proportional increases in successful request throughput.
Elevated per-request latency on all endpoints while a small number of source addresses issue oversized headers.

Detection Strategies

Inspect reverse-proxy and web application firewall logs for Accept-Language header sizes above expected norms (for example, greater than 512 bytes).
Alert on requests where Accept-Language contains a high frequency of underscore characters or malformed BCP 47 tags.
Correlate CPU usage spikes on Ech0 processes with concurrent inbound request patterns from a limited set of source IPs.

Monitoring Recommendations

Instrument Ech0 with request-duration histograms and alert when the i18n middleware span exceeds baseline by an order of magnitude.
Log the length and character composition of Accept-Language on ingress and store metrics in a centralized analytics pipeline.
Track process-level CPU time per request handler to surface algorithmic complexity abuse early.

How to Mitigate CVE-2026-79658

Immediate Actions Required

Upgrade Ech0 to version 5.0.1 or later, which enforces size and shape limits on the Accept-Language header before invoking go-i18n.
Deploy a reverse proxy or WAF rule to reject requests where Accept-Language exceeds a small byte limit (for example, 256 bytes).
Rate-limit unauthenticated requests per source IP to constrain CPU exhaustion attempts.

Patch Information

The fix ships in Ech0 5.0.1. The upstream advisory is available in the GitHub Security Advisory GHSA-mqxv-9rm6-w8qc. Operators running earlier releases should upgrade immediately. Applications embedding go-i18n should also validate Accept-Language length and reject non-conforming tags before parsing.

Workarounds

Configure the fronting reverse proxy (Nginx, Envoy, HAProxy) to strip or truncate the Accept-Language header on all inbound traffic.
Enforce a strict maximum request header size on the proxy layer, well below Go's 1 MiB default.
Apply per-client concurrency limits so a single source cannot occupy multiple worker cores simultaneously.

bash

# Nginx example: cap Accept-Language length and reject oversized headers
http {
    large_client_header_buffers 4 8k;
    map $http_accept_language $al_ok {
        default 1;
        "~^.{257,}$" 0;
    }
    server {
        if ($al_ok = 0) { return 400; }
        # proxy_pass to Ech0 backend
    }
}