CVE-2026-61629
Description
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.
How to fix
- github.com/lucasdillmann/nginx-ignition0.0.0-20260526022344-0c988fc1277c or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/lucasdillmann/nginx-ignitionGo | 0.0.0-20260126024607-cbaf0fc16ed8 ≤ v < 0.0.0-20260526022344-0c988fc1277c | 0.0.0-20260526022344-0c988fc1277c |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.