TI-2026-55156 Aliases CVE-2026-79658 GHSA-j8jc-x8v7-x64g

Ech0 before 5.0.1 Denial of Service via Accept-Language

MEDIUM 44CWE-400Published 2026-08-25 · Updated 2026-10-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00509 43rd percentileScored 2026-11-07

Fix Fixed Ech0 (lin-snow): 5.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lin-snow	Ech0	before 5.0.1	5.0.1	Patch available	CNA

Ech0 Vendorlin-snow Affected before 5.0.1 Fixed in 5.0.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:ech0:ech0::::::::	—	—	lin-snow

cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:* Versions — — ·lin-snow

Remediation

Fix · CNA Ech0 (lin-snow) Fixed in 5.0.1

Timeline

2026-10-02 Threatist record created from CVE-2026-79658
2026-10-03 Alias added: GHSA-j8jc-x8v7-x64g

References

Advisory 1

GitHub Security Advisory (GHSA-mqxv-9rm6-w8qc)

TI-2026-55162 Ech0 before 4.7.3 Access Token Revocation Bypass CVSS 4.0CRITICAL 9.1
TI-2026-55163 Ech0 before 4.5.1 Authorization Bypass via Session Tokens CVSS 4.0HIGH 8.7
TI-2026-55160 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass CVSS 4.0HIGH 8.8
TI-2026-27239 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature CVSS 3.1HIGH 7.5
TI-2026-27240 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVSS 3.1HIGH 7.2
TI-2026-55159 Ech0 before 4.7.3 Unauthenticated fav_count Modification CVSS 4.0MEDIUM 6.9

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences