Daptin versions up to 0.12.15 contain a vulnerability in their global LanguageMiddleware that parses the Accept-Language HTTP header without proper size or character filtering. The underlying Go language parser has quadratic-time complexity on malformed language tags using underscore separators, allowing an unauthenticated attacker to cause significant CPU resource exhaustion with a single crafted request. This can lead to denial of service by consuming excessive server CPU for extended periods.