THREAT OPS › Threat News › [NVD] CVE-2026-79658 (HIGH 7.5) — Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLang
[NVD] CVE-2026-79658 (HIGH 7.5) — Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLang
CVE-2026-79658 CVSS: 7.5 HIGH Published: 2026-08-25T12:16:29.123
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-'
Indicators of compromise
- CVE-2026-79658cve
- CVE-2022-32149cve
- golang.orgdomain
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-79658