CVE-2026-62160
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Daptin (a GraphQL/JSON-API headless CMS) before 0.12.26, the global LanguageMiddleware passes the raw Accept-Language header to golang.org/x/text without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, so long lists of underscore-separated language subtags bypass it and cause quadratic buffer processing. Unauthenticated requests to the public landing page or /api can exhaust server CPU.
Risk Assessment
An unauthenticated attacker can cause a denial-of-service by sending crafted headers and saturating server CPU. This can disrupt availability of the application and shared infrastructure.
Recommendation
Upgrade Daptin to version 0.12.26 or later. Additionally, consider limiting header sizes at the reverse proxy level.
Other vulnerabilities in Daptin
See all- CVE-2026-41422High
Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.
- CVE-2026-72575Critical
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.
- CVE-2025-15439Medium
In Daptin 0.10.3, the goqu.L function in server/resource/resource_aggregate.go of the Aggregate API component is vulnerable to SQL injection via manipulation of the column/group/order arguments. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS