# CVE-2026-79658: Ech0 ReDoS in Accept-Language header processing via i18n middleware

Source: https://junglewise.ai/threats/cve-2026-79658-ech0-redos-in-accept-language-header-processing-via-i18n  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79658 · Severity: high · CVSS 7.5 · Published 2026-08-25

Ech0 is a web application framework that processes HTTP headers to determine a user's language preference. The application fails to validate the Accept-Language header before processing it, allowing an attacker to craft specially-formatted headers that consume excessive CPU resources. An unauthenticated attacker can send a single malicious request to consume ~1.5 seconds of CPU; multiple concurrent requests can completely disable the server.

Technologies: [Lin-Snow Ech0](https://junglewise.ai/threats/technologies/ech0). Vendors: [Lin-Snow](https://junglewise.ai/threats/vendors/lin-snow).

## Quick answers

**Is CVE-2026-79658 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79658 being exploited in the wild.

**How severe is CVE-2026-79658?** High severity, with a CVSS score of 7.5, published 25 August 2026.

**Which products and versions are affected?** Lin-Snow Ech0 before 5.0.1.

**Is there a fix for CVE-2026-79658?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79658 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79658?** Check whether you run Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a ReDoS (regular expression denial of service) vulnerability affecting Ech0's i18n middleware, which processes the Accept-Language HTTP header on every request without size or format restrictions. The header is passed unfiltered to go-i18n's NewLocalizer, which invokes golang.org/x/text/language.ParseAcceptLanguage. Although CVE-2022-32149 previously mitigated this parser by capping '-' characters at 1000, the parser internally aliases '_' characters to '-' before parsing, but the guard does not count '_' characters. An attacker can construct a 1 MiB header using '_' separators (e.g., repeated '_abcdefghi' tokens) that bypasses the guard and triggers quadratic-time parsing behavior. The attack requires no authentication and can be triggered by sending an HTTP GET request to any endpoint. Patched in Ech0 5.0.1 and later.

## Affected products

- lin-snow Ech0 before 5.0.1

## Timeline

- 2026-06-04: disclosed: GitHub Security Advisory GHSA-mqxv-9rm6-w8qc published
- 2026-08-25: advisory: CVE-2026-79658 published in NVD

## References

- [https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc](https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc)
- [https://www.vulncheck.com/advisories/ech0-before-denial-of-service-via-accept-language](https://www.vulncheck.com/advisories/ech0-before-denial-of-service-via-accept-language)

## Related threats

- [Ech0 scope bypass in PUT /user endpoint via profile:read token](https://junglewise.ai/threats/cve-2026-79673-ech0-scope-bypass-in-put-user-endpoint-via-profile-read-token)
- [Ech0 authorization bypass in comment panel endpoints](https://junglewise.ai/threats/cve-2026-79672-ech0-authorization-bypass-in-comment-panel-endpoints)
- [Ech0 stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-79670-ech0-stored-cross-site-scripting-in-file-upload)
- [Ech0 missing authorization on system log endpoints](https://junglewise.ai/threats/cve-2026-79669-ech0-missing-authorization-on-system-log-endpoints)
- [Ech0 authentication bypass in like endpoint](https://junglewise.ai/threats/cve-2026-79668-ech0-authentication-bypass-in-like-endpoint)