—
GO-2026-6539
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
Quick fix
GO-2026-6539 — github.com/lucasdillmann/nginx-ignition: upgrade to the fixed version with the command below.
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260526022344-0c988fc1277cDetails
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/lucasdillmann/nginx-ignition
Introduced in:
0.0.0-20260126024607-cbaf0fc16ed8Fixed in: 0.0.0-20260526022344-0c988fc1277cFix
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260526022344-0c988fc1277cReferences
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-61629[ADVISORY]
- https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a[FIX]
- https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485[FIX]
- https://github.com/lucasdillmann/nginx-ignition/pull/125[FIX]
- https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1[WEB]