In nginx-ignition versions 2.29.0 through 2.40.0, the gin i18n middleware processes the Accept-Language header without limiting its size or format. The golang.org/x/text/language.ParseAcceptLanguage function used internally has quadratic-time complexity when parsing long lists of malformed language tags, especially those containing many underscore characters ('_'). Although a previous fix capped the number of hyphen characters ('-'), underscores are aliased to hyphens internally but remain uncapped, allowing attackers to craft headers that cause excessive CPU usage. A single crafted request can consume about 2.4 seconds of CPU time, and multiple concurrent requests can saturate a multi-core server, causing denial of service. This vulnerability is addressed in nginx-ignition version 2.40.1.

An unauthenticated attacker can send specially crafted HTTP requests with malicious Accept-Language headers to cause high CPU usage on the nginx-ignition server, leading to denial of service by resource exhaustion. This can saturate server CPU cores and consume significant bandwidth, degrading or disrupting service availability.

Upgrade nginx-ignition to version 2.40.1 or later, where this vulnerability is fixed by limiting the processing of underscores in the Accept-Language header. Until upgraded, consider implementing external rate limiting or filtering on Accept-Language headers to mitigate potential abuse.