CVE-2026-58436: CWE-407 in Gitea Gitea Open Source Git Server
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
AI Analysis
Technical Summary
The vulnerability in Gitea's Locale middleware arises from unfiltered processing of the Accept-Language HTTP header on unauthenticated requests. The middleware calls golang.org/x/text/language.ParseAcceptLanguage, which has quadratic-time complexity when parsing inputs containing numerous underscore characters. Attackers can exploit this by sending crafted Accept-Language headers to cause excessive CPU consumption, resulting in denial-of-service conditions. This affects all Gitea versions before 1.27.0 that do not limit the size of the Accept-Language header.
Potential Impact
Successful exploitation can cause high CPU usage on the affected Gitea server, leading to degraded availability or denial of service. The vulnerability affects unauthenticated requests, increasing the attack surface. There are no indications of data compromise or privilege escalation from this vulnerability.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that fixes this vulnerability by imposing appropriate limits on the Accept-Language header processing. Users should upgrade to version 1.27.0 or later to remediate this issue. Until patched, consider implementing network-level rate limiting or filtering on Accept-Language headers if feasible.
CVE-2026-58436: CWE-407 in Gitea Gitea Open Source Git Server
Description
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Gitea's Locale middleware arises from unfiltered processing of the Accept-Language HTTP header on unauthenticated requests. The middleware calls golang.org/x/text/language.ParseAcceptLanguage, which has quadratic-time complexity when parsing inputs containing numerous underscore characters. Attackers can exploit this by sending crafted Accept-Language headers to cause excessive CPU consumption, resulting in denial-of-service conditions. This affects all Gitea versions before 1.27.0 that do not limit the size of the Accept-Language header.
Potential Impact
Successful exploitation can cause high CPU usage on the affected Gitea server, leading to degraded availability or denial of service. The vulnerability affects unauthenticated requests, increasing the attack surface. There are no indications of data compromise or privilege escalation from this vulnerability.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that fixes this vulnerability by imposing appropriate limits on the Accept-Language header processing. Users should upgrade to version 1.27.0 or later to remediate this issue. Until patched, consider implementing network-level rate limiting or filtering on Accept-Language headers if feasible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fw57-jgch-pgf3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58436"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a600ab09c2644c7f8fe1a40
Added to database: 07/22/2026, 00:11:28 UTC
Last enriched: 08/14/2026, 12:59:15 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.