Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

Ech0 before version 5.0.1 contains a denial-of-service vulnerability in its i18n middleware that processes HTTP Accept-Language headers without any size or shape restrictions. The unfiltered header is passed to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text only caps hyphen '-' characters but not underscore '_' characters, which the parser treats as equivalent, enabling quadratic-time parsing. An attacker can craft a large Accept-Language header (up to Go's 1 MiB default) using underscore separators to consume approximately 1.5 seconds of CPU per request. Concurrent such requests can saturate all CPU cores on a multi-core server, resulting in full denial of service. No authentication is required to exploit this vulnerability, making it trivially accessible to remote attackers. The fix was introduced in Ech0 version 5.0.1.