{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/lin-snow/ech0","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-mqxv-9rm6-w8qc","id":"tcs_01M5KFGA3GGVN64D32PTGFPZAW","modified_at":"2026-07-21T19:19:26.852634936Z","published_at":"2026-07-14T19:58:54Z","references":["https://osv.dev/vulnerability/GHSA-mqxv-9rm6-w8qc","https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc","https://github.com/lin-snow/Ech0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-mqxv-9rm6-w8qc","url":"https://osv.dev/vulnerability/GHSA-mqxv-9rm6-w8qc"}],"summary":"Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware"}