The Locale middleware in Gitea calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language HTTP header without filtering. Although a previous fix (CVE-2022-32149) limits the number of '-' characters to 1000 to prevent quadratic-time parsing, it does not limit '_' characters, which the parser internally treats as '-'. An attacker can send a large Accept-Language header with many '_' separators, triggering quadratic-time parsing and causing high CPU usage. This unauthenticated denial-of-service vulnerability affects Gitea versions before 1.27.0 that do not apply size limits on the Accept-Language header. The vulnerability was verified on the official gitea/gitea:1.22.6 Docker image and the main branch code. The default Go HTTP server allows headers up to 1 MiB, enabling large malicious headers.

An unauthenticated attacker can send a specially crafted Accept-Language header with many underscore separators to trigger quadratic-time parsing in Gitea's Locale middleware. This causes high CPU consumption (~2 seconds per request) and can saturate server CPU cores when multiple requests are sent concurrently, resulting in a denial-of-service condition. The attack requires no privileges and can affect the availability of Gitea instances running vulnerable versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider implementing size or character filtering on the Accept-Language header before it reaches the ParseAcceptLanguage function to mitigate the attack. Monitoring for unusually large or malformed Accept-Language headers and rate-limiting unauthenticated requests may also help reduce impact.