Is CVE-2026-62160 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62160 being exploited in the wild.

How severe is CVE-2026-62160?

High severity, with a CVSS score of 4, published 30 October 2026.

Which products and versions are affected?

Daptin 0.12.15 and all earlier 0.12.x versions; github.com/daptin/daptin (Go) <= 0.12.15, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.12.15.

How is CVE-2026-62160 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62160?

Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62160: Daptin LanguageMiddleware CPU exhaustion via Accept-Language header

Q: Is there a fix for CVE-2026-62160?

Yes: fixed in Commit 2d709509 (master branch); fixed version not yet released at time of advisory publication. Until then: Apply input filtering to cap the combined count of hyphen (-) and underscore (_) characters in the Accept-Language header before parsing; a ceiling of 32 separators (vs. <10 in legitimate browser headers) blocks the attack while preserving normal use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62160 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62160?

Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62160 · Severity: high · CVSS 4 · Published 2026-10-30

Daptin, a backend framework that exposes APIs over HTTP, processes the Accept-Language header from every request through a parser with quadratic time complexity. An attacker can send a specially crafted header using underscore separators (which bypass an existing CVE-2022-32149 guard designed for hyphens) to consume 9–27 seconds of server CPU per request, allowing a single attacker to pin an entire server core or disable a multi-core instance with modest bandwidth.

Technologies: Daptin, github.com/daptin/daptin (Go). Vendors: Daptin, Go.

Quick answers

Is CVE-2026-62160 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62160 being exploited in the wild.
How severe is CVE-2026-62160?: High severity, with a CVSS score of 4, published 30 October 2026.
Which products and versions are affected?: Daptin 0.12.15 and all earlier 0.12.x versions; github.com/daptin/daptin (Go) <= 0.12.15, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.12.15.
Is there a fix for CVE-2026-62160?: Yes: fixed in Commit 2d709509 (master branch); fixed version not yet released at time of advisory publication. Until then: Apply input filtering to cap the combined count of hyphen (-) and underscore (_) characters in the Accept-Language header before parsing; a ceiling of 32 separators (vs. <10 in legitimate browser headers) blocks the attack while preserving normal use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62160 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62160?: Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Commit 2d709509 (master branch); fixed version not yet released at time of advisory publication

Apply input filtering to cap the combined count of hyphen (-) and underscore (_) characters in the Accept-Language header before parsing; a ceiling of 32 separators (vs. <10 in legitimate browser headers) blocks the attack while preserving normal use.

Technical details

The vulnerability exploits a bypass of CVE-2022-32149's guard in golang.org/x/text/language.ParseAcceptLanguage. The parser aliases underscore (_) to hyphen (-) internally during scanning but the guard only counts hyphens; feeding the parser a 256 KiB header of malformed _-separated tokens (e.g., "_abcdefghi" repeated) triggers O(N²) memmove operations in the scanner's gobble function. The middleware runs unauthenticated on every request without input size or character-class filtering.

Affected products

daptin daptin 0.12.15 and all earlier 0.12.x versions

Identifiers

CVE-2026-62160
GHSA-rhj7-vh3v-mcq6
GO-2026-6890

Timeline

2026-10-29: disclosed
2026-10-29: patched: Fixed on master branch in commit 2d709509

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.