{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/lin-snow/ech0","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-mqxv-9rm6-w8qc","id":"tcs_01M5KGR3XGY8MSB6ZYMZRYW00F","modified_at":"2026-07-21T19:15:33.339663230Z","published_at":"2026-07-17T19:42:05Z","references":["https://osv.dev/vulnerability/GO-2026-5981","https://github.com/lin-snow/Ech0/security/advisories/GHSA-mqxv-9rm6-w8qc"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5981","url":"https://osv.dev/vulnerability/GO-2026-5981"}],"summary":"Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0"}