{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.12.15"}],"component":"github.com/daptin/daptin","cve_ids":["CVE-2026-62160"],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rhj7-vh3v-mcq6","id":"tcs_01M6495VY4ANB8ZVSWKPBWDYV1","modified_at":"2026-10-29T16:45:05.329254013Z","published_at":"2026-10-29T16:33:09Z","references":["https://osv.dev/vulnerability/GHSA-rhj7-vh3v-mcq6","https://github.com/daptin/daptin/security/advisories/GHSA-rhj7-vh3v-mcq6","https://github.com/daptin/daptin"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-rhj7-vh3v-mcq6","url":"https://osv.dev/vulnerability/GHSA-rhj7-vh3v-mcq6"}],"summary":"Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware"}