EUVD-2026-83924
GHSA-jr34-h97m-9hpx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated single-request trigger with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is CPU/bandwidth exhaustion only, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal scanner aliases _ to - before parsing. A single unauthenticated GET request with an Accept-Language header built out of _ separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.
Articles & Coverage 1
AnalysisAI
Unauthenticated denial of service in nginx-ignition 2.29.0 through 2.40.0 lets any remote client that can reach the management API burn roughly 2.4 seconds of server CPU per request by sending a GET whose Accept-Language header is built from underscore-separated malformed language tags, since the gin i18n middleware parses the raw header unconditionally with no size or shape limit. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): ten concurrent attackers saturate a ten-core host for the duration of the attack while consuming about 10 MiB/s of upstream bandwidth, with no path to data access or code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, user interaction, or non-default configuration is required: any attacker able to send an HTTP request to the nginx-ignition API server (versions 2.29.0-2.40.0) can trigger the flaw, because the gin i18n middleware runs in front of every request and parses the raw Accept-Language header unconditionally. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability-only threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade nginx-ignition to version 2.40.1, which caps the combined count of '-' and '_' characters in the Accept-Language header at 10 and discards over-long headers before they reach the parser (see GHSA-jr34-h97m-9hpx and commits 0c988fc1277c7d291725e8373313f8486fa1b31a / cbaf0fc16ed873f7178a2ca9b0d00a696e44b485). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every nginx-ignition instance and confirm which are running versions 2.29.0 through 2.40.0, then immediately restrict network access to the management API to trusted management networks or administrative hosts only, since the flaw is unauthenticated and requires only reachability of that interface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today