CVE-2026-61630

In nginx ignition versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags; the CVE-2022-32149 guard caps the number of '-' characters at 1000 but does not cap '_' characters even though the parser's internal scanner aliases '_' to '-' before parsing. A single unauthenticated GET request with an Accept-Language header built out of '_' separators burns about 2.4 seconds of server CPU.

In nginx ignition prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race.