Is CVE-2026-79658 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79658 being exploited in the wild.

How severe is CVE-2026-79658?

High severity, with a CVSS score of 7.5, published 25 August 2026.

Is there a fix for CVE-2026-79658?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79658 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79658?

Check whether you run Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79658: Ech0 ReDoS in Accept-Language header processing via i18n middleware

CVE-2026-79658 · Severity: high · CVSS 7.5 · Published 2026-08-25

Ech0 is a web application framework that processes HTTP headers to determine a user's language preference. The application fails to validate the Accept-Language header before processing it, allowing an attacker to craft specially-formatted headers that consume excessive CPU resources. An unauthenticated attacker can send a single malicious request to consume ~1.5 seconds of CPU; multiple concurrent requests can completely disable the server.

Technologies: Lin-Snow Ech0. Vendors: Lin-Snow.

Quick answers

Is CVE-2026-79658 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79658 being exploited in the wild.
How severe is CVE-2026-79658?: High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?: Lin-Snow Ech0 before 5.0.1.
Is there a fix for CVE-2026-79658?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79658 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79658?: Check whether you run Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a ReDoS (regular expression denial of service) vulnerability affecting Ech0's i18n middleware, which processes the Accept-Language HTTP header on every request without size or format restrictions. The header is passed unfiltered to go-i18n's NewLocalizer, which invokes golang.org/x/text/language.ParseAcceptLanguage. Although CVE-2022-32149 previously mitigated this parser by capping '-' characters at 1000, the parser internally aliases '_' characters to '-' before parsing, but the guard does not count '_' characters. An attacker can construct a 1 MiB header using '_' separators (e.g., repeated '_abcdefghi' tokens) that bypasses the guard and triggers quadratic-time parsing behavior. The attack requires no authentication and can be triggered by sending an HTTP GET request to any endpoint. Patched in Ech0 5.0.1 and later.

Affected products

lin-snow Ech0 before 5.0.1

Timeline

2026-06-04: disclosed: GitHub Security Advisory GHSA-mqxv-9rm6-w8qc published
2026-08-25: advisory: CVE-2026-79658 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.