CVE-2026-58436

HighCVSS 7.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

ParseAcceptLanguage in the Locale middleware causes a quadratic-time DoS on unauthenticated requests. Sending specially crafted Accept-Language headers can overload the server.

Risk Assessment

An attacker can easily overload the server, causing service unavailability for all users. This can lead to downtime and financial losses.

Recommendation

Update Gitea to a patched version and consider limiting the Accept-Language header length at the proxy level. Monitor traffic for anomalies.

Original NVD description (English source)

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests