CVE-2026-61629
2 advisories.
Go/github.com/lucasdillmann/nginx-ignition CVE-2026-61629: high 7.5, EPSS 0.42%
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
Action: Upgrade github.com/lucasdillmann/nginx-ignition to 0.0.0-20260526022344-0c988fc1277c or later.
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260526022344-0c988fc1277cAffected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.0-20260126024607-cbaf0fc16ed8 | 0.0.0-20260526022344-0c988fc1277c | - |
Fixed versions
| 0.0.0-20260526022344-0c988fc1277c |
Sources
- osv: GHSA-jr34-h97m-9hpx
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-61629
- https://github.com/lucasdillmann/nginx-ignition/pull/125
- https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
- https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485
- https://github.com/lucasdillmann/nginx-ignition
- https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1
CVE-2026-61629 · published · modified · JSON
Go/github.com/lucasdillmann/nginx-ignition CVE-2026-61629: unknown, EPSS 0.42%
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
Action: Upgrade github.com/lucasdillmann/nginx-ignition to 0.0.0-20260526022344-0c988fc1277c or later.
go get github.com/lucasdillmann/nginx-ignition@v0.0.0-20260526022344-0c988fc1277cAffected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.0-20260126024607-cbaf0fc16ed8 | 0.0.0-20260526022344-0c988fc1277c | - |
Fixed versions
| 0.0.0-20260526022344-0c988fc1277c |
Sources
- osv: GO-2026-6539
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-61629
- https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
- https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485
- https://github.com/lucasdillmann/nginx-ignition/pull/125
- https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1
CVE-2026-61629 · published · modified · JSON