DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61629: CVE-2026-61629: CPU Amplification Denial of Service via ParseAcceptLanguage Underscore Bypass

#security #cve #cybersecurity

CVE-2026-61629: CPU Amplification Denial of Service via ParseAcceptLanguage Underscore Bypass

Vulnerability ID: CVE-2026-61629
CVSS Score: 7.5
Published: 2026-09-21

A vulnerability exists in the i18n middleware of nginx-ignition, enabling CPU amplification attacks. By transmitting a crafted Accept-Language header containing malformed tags separated by underscores, an unauthenticated remote attacker can bypass the length-guard threshold of the underlying Go parsing library. Normalization of underscores to hyphens occurs after the initial validation checks, forcing the parser into expensive quadratic-time loops that consume 100% of available CPU resources. This leads to a complete denial of service for the administrative API and potentially degrades the availability of the hosting system. This vulnerability has been resolved in version 2.40.1.

TL;DR

Unauthenticated remote CPU amplification vulnerability in nginx-ignition version 2.29.0 through 2.40.0 allowed attackers to trigger a Denial of Service (DoS) by sending crafted Accept-Language headers with excessive underscore separators.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS Score: 7.5
  • EPSS Score: 0.0
  • Exploit Status: PoC
  • KEV Status: Not Listed

Affected Systems

  • nginx-ignition versions 2.29.0 through 2.40.0

Mitigation Strategies

  • Upgrade nginx-ignition to version 2.40.1 or above.
  • Deploy reverse-proxy or WAF rules to sanitize or drop excessively long Accept-Language headers with underscores or hyphens.
  • Restrict access to administrative ports using network firewalls or access control lists.

Remediation Steps:

  1. Identify running instances of nginx-ignition and verify their active version.
  2. Apply the updated release 2.40.1 or rebuild with Go 1.25.6 and upgraded text dependencies.
  3. Configure Nginx upstream reverse proxy filtering for Accept-Language headers if deployment patches are delayed.
  4. Restart the service and monitor CPU metrics under load.

References

Read the full report for CVE-2026-61629 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)