Ech0 CVE-2026-79658

The vulnerability is exploitable against any Ech0 instance running the default configuration, where internal/i18n.Middleware() is wired on the global gin router without an upstream Accept-Language size filter - this is the standard documented deployment for all 4.x releases. No authentication is required: the middleware executes before any authentication logic on every HTTP request, including the public landing page, public comments feed, and the unauthenticated /api/echo/page endpoint. The only inherent limiting factor is Go's default 1 MiB HTTP header size cap, which bounds - but does not prevent - the per-request CPU amplification. Exploitation is constrained in practice only by network-layer controls such as WAF rules truncating oversized Accept-Language headers or rate-limiting reducing concurrent attack throughput. No non-default configuration, specific deployment mode, or elevated privilege is required.

The CVSS 4.0 score of 8.7 is well-grounded: AV:N/AC:L/AT:N/PR:N/UI:N with VA:H correctly characterises a trivially exploitable, unauthenticated network attack that causes high availability impact. There are no conflicting signals across the available data - the CVE description, CVSS vector, and GHSA advisory all consistently confirm unauthenticated exploitation against default Ech0 deployments with no special prerequisites. EPSS data is absent from the provided intelligence, so exploitation probability is inferred from the attack profile: extremely low effort to execute (a single crafted HTTP request) but constrained in blast radius by Ech0's limited deployment footprint. No CISA KEV listing is present and no independently confirmed public exploit code exists, though the GHSA advisory provides precise technical detail - including the specific '_' bypass of the CVE-2022-32149 guard - that would allow trivial reproduction by any competent attacker. The ~10 MiB/s sustained bandwidth requirement per attacker and the anomalously high CPU utilisation provide modest detection opportunities via traffic and process monitoring. The primary real-world risk reduction factor is Ech0's narrow deployment footprint rather than any inherent exploitation difficulty.

An unauthenticated attacker sends a stream of HTTP GET requests to any public Ech0 endpoint - such as the landing page or /api/echo/page - each carrying an Accept-Language header approaching Go's 1 MiB default limit, composed of underscore-separated pseudo-language tags chosen to bypass the CVE-2022-32149 '-' cap. Each request triggers O(n²) parsing and consumes approximately 1.5 seconds of CPU; ten concurrent attackers sustaining this pattern can fully saturate a ten-core Ech0 host and deny service to all legitimate users. No independently confirmed public exploit code exists, but the GHSA advisory provides precise construction details sufficient for trivial reproduction.