Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

Description

References

• lin-snow/Ech0 security advisory · ADVISORY

Weitere Schwachstellen in github.com/lin-snow/ech0

• CVE-2026-79673MITTEL 6.5Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including pass…
• CVE-2026-79672MITTEL 5.5Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scop…
• CVE-2026-79671MITTEL 5.5Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), whic…
• CVE-2026-79670MITTEL 4.8Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only cl…
• CVE-2026-79669MITTEL 4.3Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server…