{"id":"GO-2026-6539","summary":"nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition","details":"nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition","aliases":["CVE-2026-61629","GHSA-jr34-h97m-9hpx"],"modified":"2026-09-28T17:00:25.959306615Z","published":"2026-09-28T16:43:40Z","database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6539"},"references":[{"type":"ADVISORY","url":"https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61629"},{"type":"FIX","url":"https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a"},{"type":"FIX","url":"https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485"},{"type":"FIX","url":"https://github.com/lucasdillmann/nginx-ignition/pull/125"},{"type":"WEB","url":"https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1"}],"affected":[{"package":{"name":"github.com/lucasdillmann/nginx-ignition","ecosystem":"Go","purl":"pkg:golang/github.com/lucasdillmann/nginx-ignition"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20260126024607-cbaf0fc16ed8"},{"fixed":"0.0.0-20260526022344-0c988fc1277c"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6539.json"}}],"schema_version":"1.9.0"}