CVE-2026-79658: Uncontrolled Resource Consumption in lin-snow Ech0

Ech0 before version 5.0.1 does not limit the size or shape of the Accept-Language header processed by its internationalization middleware. The header is passed unfiltered to go-i18n's NewLocalizer, which calls golang.org/x/text/language.ParseAcceptLanguage. A previous mitigation (CVE-2022-32149) capped '-' characters but did not address '_' characters, which the parser treats as '-'. This allows an attacker to craft large headers (up to 1 MiB) with underscores that cause quadratic-time parsing, consuming approximately 1.5 seconds of CPU per request. Multiple concurrent requests can saturate a multi-core server, resulting in denial of service.

An unauthenticated attacker can exploit this vulnerability to cause high CPU usage on the server by sending large Accept-Language headers with underscore separators. This can degrade server performance and potentially cause denial of service by exhausting CPU resources, especially under concurrent attack conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a fix is available, consider implementing request size limits or filtering on the Accept-Language header to mitigate potential exploitation.