Is CVE-2026-61629 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61629 being exploited in the wild.

How severe is CVE-2026-61629?

High severity, with a CVSS score of 7.5, published 21 September 2026.

Which products and versions are affected?

github.com/lucasdillmann/nginx-ignition (Go) >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277c, SEMVER:introduced=0.0.0-20260126024607-cbaf0fc16ed8,fixed=0.0.0-20260526022344-0c988fc1277c.

Is there a fix for CVE-2026-61629?

Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260526022344-0c988fc1277c or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61629 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61629?

Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61629: nginx-ignition i18n middleware CPU amplification via Accept-Language header

Q: Is there a fix for CVE-2026-61629?

Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260526022344-0c988fc1277c or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61629 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-61629?

Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61629 · Severity: high · CVSS 7.5 · Published 2026-09-21

nginx-ignition is a self-hosted API server that processes incoming HTTP requests. The application's i18n middleware parses the Accept-Language header without size validation, allowing an unauthenticated attacker to send a crafted header using underscore separators that bypasses an existing security guard in Go's language parser. A single malicious request can consume 2-3 seconds of CPU; ten concurrent attackers can saturate a 10-core server and cause service degradation or denial of service.

Technologies: github.com/lucasdillmann/nginx-ignition (Go). Vendors: Go.

Quick answers

Is CVE-2026-61629 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61629 being exploited in the wild.
How severe is CVE-2026-61629?: High severity, with a CVSS score of 7.5, published 21 September 2026.
Which products and versions are affected?: github.com/lucasdillmann/nginx-ignition (Go) >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277c, SEMVER:introduced=0.0.0-20260126024607-cbaf0fc16ed8,fixed=0.0.0-20260526022344-0c988fc1277c.
Is there a fix for CVE-2026-61629?: Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260526022344-0c988fc1277c or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61629 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61629?: Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260526022344-0c988fc1277c or later
```
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260526022344-0c988fc1277c
```

Technical details

The vulnerability is a quadratic-time algorithmic complexity issue (CWE-1333) in the interaction between nginx-ignition's i18n middleware and golang.org/x/text/language.ParseAcceptLanguage. The middleware calls ParseAcceptLanguage on the raw Accept-Language HTTP header without filtering. Go's language parser includes a guard (CVE-2022-32149) that rejects inputs with more than 1000 hyphen (`-`) characters, but the parser internally aliases underscore (`_`) to hyphen before parsing. An attacker sends an Accept-Language header composed of underscore-separated tokens (e.g., `en_abcdefghi_abcdefghi...`), which bypasses the hyphen-count guard and triggers the parser's O(N²) scanning behavior. The middleware runs globally on every HTTP request, including unauthenticated endpoints like `/api/health`, so no authentication is required. The attack achieves denial of service by consuming server CPU resources, burning ~2.4 seconds per 1 MiB header on tested hardware (~75-110x amplification vs. legitimate traffic).

Affected products

lucasdillmann nginx-ignition v2.40.0 and earlier 2.x versions

Identifiers

CVE-2026-61629
GHSA-jr34-h97m-9hpx
GO-2026-6539

Timeline

2026-09-21: disclosed: Advisory published
2026: other: CVE-2026-61629 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.