CVE-2026-62160 daptin CVE debrief

Who should care

Defenders of Daptin hosts, especially those with publicly accessible APIs, should assess exposure and potential impact of CPU amplification attacks. They should verify exposure, review compensating controls, and monitor for unusual CPU usage patterns. Security teams and operators should prioritize verifying exposure and assessing impact to ensure the security of their environments.

Why it matters

CVE-2026-62160 allows for CPU amplification via crafted Accept-Language headers in Daptin's LanguageMiddleware, potentially leading to denial-of-service conditions. Defenders should verify exposure, especially for publicly accessible APIs, and assess potential impact.

• CPU amplification can lead to denial-of-service conditions
• Potential for significant CPU consumption with crafted requests
• Requires verification of exposure and impact for Daptin hosts
• Remediation priority for publicly accessible Daptin APIs

Technical summary

Daptin's LanguageMiddleware calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header of every HTTP request without size or shape filtering. The underlying parser has quadratic-time behavior on long lists of malformed language tags. A single unauthenticated GET request with a crafted Accept-Language header can consume significant server CPU. This can lead to denial-of-service conditions. Defenders should verify exposure, especially for publicly accessible APIs, and assess potential impact. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal scanner

Defensive priority

Defenders should prioritize verifying exposure of Daptin hosts, especially those with publicly accessible APIs, and assess the impact of potential CPU amplification attacks.

Recommended defensive actions

• Verify exposure of Daptin hosts, especially those with publicly accessible APIs
• Assess the impact of potential CPU amplification attacks
• Implement size limits on Accept-Language headers
• Monitor for unusual CPU usage patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in Daptin's LanguageMiddleware, which allows for CPU amplification via the Accept-Language header. Evidence is based on the source item and CVE record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.