CVE-2026-79671 is a server-side request forgery (SSRF) vulnerability in Ech0 before version 4.4.3. The vulnerability exists in the validateWebhookURL function, which fails to properly validate hostnames that DNS-resolve to private or internal IPs. An attacker with admin privileges can exploit this by creating a webhook with a malicious hostname, potentially leading to unauthorized requests to internal ser [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T12:16:29.123Z and has not been modified since then. Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. This vulnerability can lead to denial of service attacks with large, specially crafted he [truncated]
