---
id: GO-2026-5981
aliases:
  - GHSA-mqxv-9rm6-w8qc
title: >-
  Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification
  via Accept-Language header in i18n.Middleware in github.com…
summary: >-
  Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification
  via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0
severity: none
vendor: lin-snow
product: github.com/lin-snow/ech0
ecosystem: go
affected:
  - github.com/lin-snow/ech0
published: '2026-07-17'
updated: '2026-07-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5981'
references:
  - url: 'https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc'
tags:
  - osv
  - go
ingestedAt: '2026-07-22T15:33:23.761Z'
---

## Overview

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

## Affected packages

- `github.com/lin-snow/ech0`

## Remediation

Refer to the advisory for the patched release.