Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

Mô tả

Tham khảo

• lin-snow/Ech0 security advisory · ADVISORY

Lỗ hổng khác của github.com/lin-snow/ech0

• CVE-2026-79673TRUNG BÌNH 6.5Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including pass…
• CVE-2026-79672TRUNG BÌNH 5.5Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scop…
• CVE-2026-79671TRUNG BÌNH 5.5Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), whic…
• CVE-2026-79670TRUNG BÌNH 4.8Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only cl…
• CVE-2026-79669TRUNG BÌNH 4.3Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server…