CVE-2026-61629High· 7.5▾ MidnightPoC availablenginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptL…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.6%
Exploit / PoC code exists
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of - characters in the input at 1000, but it does not cap _ characters even though the parser's internal scanner aliases _ to - before parsing. A single unauthenticated GET request with an Accept-Language header built out of _ separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/lucasdillmann/nginx-ignition >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277cPatched in:
github.com/lucasdillmann/nginx-ignition 0.0.0-20260526022344-0c988fc1277cField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61628High· 8.1nginx ignition is a user interface for the nginx web server
CVE-2026-61630Medium· 4.2nginx ignition is a user interface for the nginx web server
CVE-2026-100350Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-101917Medium· 5.3PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-100650Medium· 6.5vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-p…
CVE-2025-61726High· 7.5The net/url package does not set a limit on the number of query parameters in a query