{"id":"GO-2026-5981","aliases":["GHSA-mqxv-9rm6-w8qc"],"title":"Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…","summary":"Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0","severity":"none","vendor":"lin-snow","product":"github.com/lin-snow/ech0","ecosystem":"go","affected":["github.com/lin-snow/ech0"],"published":"2026-07-17","updated":"2026-07-21","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5981","references":[{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc"}],"tags":["osv","go"],"ingestedAt":"2026-07-22T15:33:23.761Z","slug":"GO-2026-5981","body":"## Overview\n\nEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0\n\n## Affected packages\n\n- `github.com/lin-snow/ech0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}