# CVE-2026-61629: nginx-ignition i18n middleware CPU amplification via Accept-Language header

Source: https://junglewise.ai/threats/cve-2026-61629-nginx-ignition-i18n-middleware-cpu-amplification-via-accept  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61629 · Severity: high · CVSS 7.5 · Published 2026-09-21

nginx-ignition is a self-hosted API server that processes incoming HTTP requests. The application's i18n middleware parses the Accept-Language header without size validation, allowing an unauthenticated attacker to send a crafted header using underscore separators that bypasses an existing security guard in Go's language parser. A single malicious request can consume 2-3 seconds of CPU; ten concurrent attackers can saturate a 10-core server and cause service degradation or denial of service.

Technologies: [github.com/lucasdillmann/nginx-ignition (Go)](https://junglewise.ai/threats/technologies/github-com-lucasdillmann-nginx-ignition). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-61629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61629 being exploited in the wild.

**How severe is CVE-2026-61629?** High severity, with a CVSS score of 7.5, published 21 September 2026.

**Which products and versions are affected?** github.com/lucasdillmann/nginx-ignition (Go) >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277c, SEMVER:introduced=0.0.0-20260126024607-cbaf0fc16ed8,fixed=0.0.0-20260526022344-0c988fc1277c.

**Is there a fix for CVE-2026-61629?** Yes. github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260526022344-0c988fc1277c or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61629 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61629?** Check whether you run github.com/lucasdillmann/nginx-ignition (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lucasdillmann/nginx-ignition (Go): upgrade to 0.0.0-20260526022344-0c988fc1277c or later

  ```sh
  go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260526022344-0c988fc1277c
  ```


## Technical details

The vulnerability is a quadratic-time algorithmic complexity issue (CWE-1333) in the interaction between nginx-ignition's i18n middleware and golang.org/x/text/language.ParseAcceptLanguage. The middleware calls ParseAcceptLanguage on the raw Accept-Language HTTP header without filtering. Go's language parser includes a guard (CVE-2022-32149) that rejects inputs with more than 1000 hyphen (`-`) characters, but the parser internally aliases underscore (`_`) to hyphen before parsing. An attacker sends an Accept-Language header composed of underscore-separated tokens (e.g., `en_abcdefghi_abcdefghi...`), which bypasses the hyphen-count guard and triggers the parser's O(N²) scanning behavior. The middleware runs globally on every HTTP request, including unauthenticated endpoints like `/api/health`, so no authentication is required. The attack achieves denial of service by consuming server CPU resources, burning ~2.4 seconds per 1 MiB header on tested hardware (~75-110x amplification vs. legitimate traffic).

## Affected products

- lucasdillmann nginx-ignition v2.40.0 and earlier 2.x versions

## Identifiers

- CVE-2026-61629
- GHSA-jr34-h97m-9hpx
- GO-2026-6539

## Timeline

- 2026-09-21: disclosed: Advisory published
- 2026: other: CVE-2026-61629 assigned

## Related threats

- [nginx ignition TOTP reuse during validity window](https://junglewise.ai/threats/cve-2026-61630-nginx-ignition-totp-reuse-during-validity-window)
- [nginx ignition unauthenticated admin account creation via onboarding race condition](https://junglewise.ai/threats/cve-2026-61628-nginx-ignition-unauthenticated-admin-account-creation-via)