Executive brief
nginx-ignition is a self-hosted API server that processes incoming HTTP requests. The application's i18n middleware parses the Accept-Language header without size validation, allowing an unauthenticated attacker to send a crafted header using underscore separators that bypasses an existing security guard in Go's language parser. A single malicious request can consume 2-3 seconds of CPU; ten concurrent attackers can saturate a 10-core server and cause service degradation or denial of service.
Technical details
The vulnerability is a quadratic-time algorithmic complexity issue (CWE-1333) in the interaction between nginx-ignition's i18n middleware and golang.org/x/text/language.ParseAcceptLanguage. The middleware calls ParseAcceptLanguage on the raw Accept-Language HTTP header without filtering. Go's language parser includes a guard (CVE-2022-32149) that rejects inputs with more than 1000 hyphen (`-`) characters, but the parser internally aliases underscore (`_`) to hyphen before parsing. An attacker sends an Accept-Language header composed of underscore-separated tokens (e.g., `en_abcdefghi_abcdefghi...`), which bypasses the hyphen-count guard and triggers the parser's O(N²) scanning behavior. The middleware runs globally on every HTTP request, including unauthenticated endpoints like `/api/health`, so no authentication is required. The attack achieves denial of service by consuming server CPU resources, burning ~2.4 seconds per 1 MiB header on tested hardware (~75-110x amplification vs. legitimate traffic).
Affected products
- lucasdillmann nginx-ignition v2.40.0 and earlier 2.x versions
Timeline
- 2026-09-21: disclosed: Advisory published
- 2026: other: CVE-2026-61629 assigned