Description

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T17:17:27.600Z",
  "pubdate": "2026-08-13T17:17:27.600Z",
  "executiveSummary": "A quadratic-time Denial of Service (DoS) vulnerability exists in the ParseAcceptLanguage parsing mechanism utilized by the Locale middleware. This security flaw enables unauthenticated remote attackers to exhaust server resources and disrupt application availability.\nThe vulnerability stems from inefficient algorithmic complexity during the processing of maliciously crafted HTTP Accept-Language header values. When an application processes these oversized or deeply nested strings, CPU utilization spikes significantly, leading to application degradation or complete unresponsiveness.\nThe impacted systems include applications utilizing the vulnerable ParseAcceptLanguage implementation within their Locale middleware stack. Because the attack vector targets unauthenticated requests, any exposed web endpoint relying on the vulnerable parser is susceptible to exploitation without requiring prior access or specialized privileges.\nThe primary risk implication is service disruption resulting from resource exhaustion. Attackers can leverage low-bandwidth, low-volume requests containing specific payload structures to sustain high CPU load, effectively mounting a denial of service attack against the target infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in algorithmic complexity issues within the ParseAcceptLanguage function when handling specific string inputs. The underlying parsing logic processes the Accept-Language header in a manner that exhibits quadratic time complexity ($O(n^2)$) relative to the length and structure of the input string.\nThe vulnerable component is the Locale middleware, specifically the function responsible for parsing and weighting language preference strings provided by clients via the HTTP Accept-Language header. Unauthenticated network exposure of endpoints invoking this middleware allows any remote client to supply arbitrary input to the parser.\nNo privileges or authentication are required to trigger the vulnerability, as the parsing occurs during the initial request handling phase prior to authentication checks. Attackers exploit this by transmitting HTTP requests with a meticulously crafted Accept-Language header designed to maximize computational overhead during parsing.\nThe attack flow proceeds as follows: 1. The attacker crafts an HTTP request containing a specialized, lengthy, or highly repetitive Accept-Language header payload. 2. The web application receives the request and routes it through the Locale middleware. 3. The ParseAcceptLanguage function attempts to parse the header values, invoking string manipulation and sorting operations that scale quadratically with the input size. 4. The CPU becomes saturated processing the nested or excessive language tokens. 5. Concurrently arriving legitimate requests experience severe latency or timeouts due to thread or process starvation, resulting in a denial of service.\nThe post-exploitation impact is strictly focused on availability, manifesting as resource exhaustion, elevated CPU utilization, and potential application crashes or gateway timeouts. The flaw does not allow for remote code execution, authentication bypass, or unauthorized data access."
}