# CVE-2026-62160: Daptin LanguageMiddleware CPU exhaustion via Accept-Language header

Source: https://junglewise.ai/threats/cve-2026-62160-daptin-parseacceptlanguage-separator-bypass-enables-250x-cpu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-62160 · Severity: high · CVSS 4 · Published 2026-10-30

Daptin, a backend framework that exposes APIs over HTTP, processes the Accept-Language header from every request through a parser with quadratic time complexity. An attacker can send a specially crafted header using underscore separators (which bypass an existing CVE-2022-32149 guard designed for hyphens) to consume 9–27 seconds of server CPU per request, allowing a single attacker to pin an entire server core or disable a multi-core instance with modest bandwidth.

Technologies: [Daptin](https://junglewise.ai/threats/technologies/daptin), [github.com/daptin/daptin (Go)](https://junglewise.ai/threats/technologies/github-com-daptin-daptin). Vendors: [Daptin](https://junglewise.ai/threats/vendors/daptin), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-62160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62160 being exploited in the wild.

**How severe is CVE-2026-62160?** High severity, with a CVSS score of 4, published 30 October 2026.

**Which products and versions are affected?** Daptin 0.12.15 and all earlier 0.12.x versions; github.com/daptin/daptin (Go) <= 0.12.15, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.12.15.

**Is there a fix for CVE-2026-62160?** Yes: fixed in Commit 2d709509 (master branch); fixed version not yet released at time of advisory publication. Until then: Apply input filtering to cap the combined count of hyphen (-) and underscore (_) characters in the Accept-Language header before parsing; a ceiling of 32 separators (vs. <10 in legitimate browser headers) blocks the attack while preserving normal use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62160 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62160?** Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Commit 2d709509 (master branch); fixed version not yet released at time of advisory publication

Apply input filtering to cap the combined count of hyphen (-) and underscore (_) characters in the Accept-Language header before parsing; a ceiling of 32 separators (vs. <10 in legitimate browser headers) blocks the attack while preserving normal use.

## Technical details

The vulnerability exploits a bypass of CVE-2022-32149's guard in golang.org/x/text/language.ParseAcceptLanguage. The parser aliases underscore (_) to hyphen (-) internally during scanning but the guard only counts hyphens; feeding the parser a 256 KiB header of malformed _-separated tokens (e.g., "_abcdefghi" repeated) triggers O(N²) memmove operations in the scanner's gobble function. The middleware runs unauthenticated on every request without input size or character-class filtering.

## Affected products

- daptin daptin 0.12.15 and all earlier 0.12.x versions

## Identifiers

- CVE-2026-62160
- GHSA-rhj7-vh3v-mcq6
- GO-2026-6890

## Timeline

- 2026-10-29: disclosed
- 2026-10-29: patched: Fixed on master branch in commit 2d709509

## Related threats

- [Daptin authorization bypass allowing unauthorized data access](https://junglewise.ai/threats/cve-2026-72575-daptin-authorization-bypass-allowing-unauthorized-data-access)
- [GO-2026-5640 - Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API in github.com/daptin/daptin](https://junglewise.ai/threats/cve-2026-41422-daptin-sql-injection-via-unvalidated-goqu-l-calls-in-aggregate)
- [GO-2026-5555 - Daptin fuzzy search injects unvalidated column name into raw SQL in github.com/daptin/daptin](https://junglewise.ai/threats/cve-2026-44349-daptin-fuzzy-search-injects-unvalidated-column-name-into-raw-sql)
- [GO-2026-5285 - Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin](https://junglewise.ai/threats/go-2026-5285-daptin-has-unauthenticated-path-traversal-and-zip-slip-in-74dbcb87)
- [GO-2026-4991 - Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password…](https://junglewise.ai/threats/go-2026-4991-daptin-s-session-management-vulnerability-leads-to-3b1b4e09)