EUVD-2026-65456
GHSA-j8jc-x8v7-x64g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated attack with no complexity prerequisites; impact is pure availability exhaustion with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).
AnalysisAI
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a quadratic-time parsing bypass in the Accept-Language header processing chain. The i18n middleware, active on every HTTP request including unauthenticated public endpoints, forwards the raw header without size filtering to golang.org/x/text/language.ParseAcceptLanguage, where the CVE-2022-32149 mitigation caps '-' separators at 1000 but not '_' separators - which the parser aliases to '-' internally - enabling a single crafted 1 MiB request to consume roughly 1.5 seconds of CPU (~70x amplification). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is exploitable against any Ech0 instance running the default configuration, where internal/i18n.Middleware() is wired on the global gin router without an upstream Accept-Language size filter - this is the standard documented deployment for all 4.x releases. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 is well-grounded: AV:N/AC:L/AT:N/PR:N/UI:N with VA:H correctly characterises a trivially exploitable, unauthenticated network attack that causes high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a stream of HTTP GET requests to any public Ech0 endpoint - such as the landing page or /api/echo/page - each carrying an Accept-Language header approaching Go's 1 MiB default limit, composed of underscore-separated pseudo-language tags chosen to bypass the CVE-2022-32149 '-' cap. Each request triggers O(n²) parsing and consumes approximately 1.5 seconds of CPU; ten concurrent attackers sustaining this pattern can fully saturate a ten-core Ech0 host and deny service to all legitimate users. … |
| Remediation | The primary fix is upgrading to Ech0 5.0.1 per the CVE description and GHSA advisory; however, the package metadata field 'fixed in: None' indicates the 5.0.1 release had not been confirmed as published at time of analysis - verify release availability at https://github.com/lin-snow/Ech0/releases before scheduling the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Ech0 deployments and identify which instances run versions before 5.0.1, prioritizing internet-facing and production systems for immediate assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today