Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)

Gitea's Locale middleware passes the raw `Accept-Language` HTTP header to `golang.org/x/text/language.ParseAcceptLanguage` without imposing a size or character-class filter. The existing CVE-2022-32149 guard caps hyphen (`-`) separators at 1000 but does not cap underscore (`_`) characters, which the parser internally aliases to hyphens before entering an O(N²) scanning path. A single unauthenticated GET request carrying a 1 MiB `Accept-Language` header composed of `_` separators consumes approximately 2 seconds of server CPU, allowing ten concurrent attackers to saturate a ten-core Gitea instance indefinitely using roughly 10 MiB/s of upstream bandwidth. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS ? · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3 Details: https://vuln.today/cve/CVE-2026-58436