Zero Radar
← feed
HighVulnerabilityCVE-2026-62160updated 30 Oct 2026, 19:19 UTC

Daptin CMS can be slowed to a crawl by one oversized language header

A single web request with a very long, malformed language header can make the server spend a lot of processing power on it. Repeating that request can make the site unresponsive for everyone.

Fixed in 0.12.26 · out Official, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes0.12.26 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends one crafted request, no login needed
  2. 2InternetRequest travels to the public port
  3. 3Daptin middlewareRaw Accept-Language header is parsed
  4. 4CPU exhaustedQuadratic parsing of underscore subtags
  5. ResultServer becomes slow or unresponsive

What happened

Daptin's global LanguageMiddleware passes the raw Accept-Language header to golang.org/x/text's ParseAcceptLanguage without size or shape limits. Underscore-separated malformed subtags bypass the existing hyphen-only guard (CVE-2022-32149), causing quadratic-time parsing and CPU exhaustion.

Why it is dangerous: Anyone who can reach the Daptin HTTP port, without logging in, can cause heavy server CPU use, and a small uplink is enough to keep a host busy. This affects every Daptin deployment reachable from the internet.

Are you affected?

You are affected if you run Daptin version 0.12.15 or earlier 0.12.x releases with the default global language middleware, and the HTTP port (8080 by default) is reachable by untrusted clients.

Package / productAffected versionsFixed in
github.com/daptin/daptin · go<= 0.12.15no fix yet

What to do

  1. Update Daptin to version 0.12.26 or later
  2. If you cannot update right away, limit or block requests with very large Accept-Language headers at a reverse proxy or load balancer
  3. Restrict public access to the Daptin port where possible and monitor server CPU for unusual spikes

Timeline

  1. 29 Oct 2026, 16:33 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:33 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 29 Oct 2026, 16:33 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 19:19 UTC
    NVD reported on it · NVD
  5. 30 Oct 2026, 19:19 UTC
    Fix: 0.12.26

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62160 · GHSA-rhj7-vh3v-mcq6
CVSS
8.7 / 10
Disclosed
29 Oct 2026, 16:33 UTC
On Zero Radar
29 Oct 2026, 16:33 UTC (0 min after disclosure)
Last change
30 Oct 2026, 19:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Daptin CMS can be slowed to a crawl by one oversized language header · Zero Radar