lin-snow Ech0 CPU amplification in i18n Middleware

Executive brief

Ech0 is a web framework component used for internationalization (i18n). A vulnerability in how it processes language preferences allows an unauthenticated attacker to overwhelm the server's processor by sending a specially crafted web request. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive to legitimate users, potentially causing significant operational downtime.

Technical details

The i18n middleware in Ech0 passes the raw 'Accept-Language' HTTP header to the 'golang.org/x/text/language' parser without size or content validation. While the underlying Go library contains a guard against quadratic-time complexity for '-' separators, it fails to account for '_' separators, which are internally aliased to '-'. An attacker can send a 1MB header containing thousands of '_' separators to trigger O(N²) behavior in the parser's scanner. This results in significant CPU consumption (approx. 1.5s per request), enabling unauthenticated remote attackers to saturate server resources with minimal bandwidth. The issue is addressed in version 5.0.1 by implementing a limit on the number of separators allowed in the header.

Affected products

• lin-snow Ech0 < 5.0.1

Timeline

• 2026-06-04: disclosed
• 2026-07-14: advisory

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D