{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58436", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-06-30T18:57:20.616Z", "datePublished": "2026-08-13T16:44:52.210Z", "dateUpdated": "2026-08-14T17:14:59.535Z"}, "containers": {"cna": {"title": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests", "descriptions": [{"lang": "en", "value": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests"}], "affected": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"version": "0", "lessThanOrEqual": "1.26.4", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "description": "CWE-407", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3", "name": "GitHub Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0", "name": "Gitea v1.27.0 Release", "tags": ["release-notes"]}, {"url": "https://blog.gitea.com/gitea-1.27.0-is-released/", "name": "Gitea v1.27.0 Release Blog Post", "tags": ["release-notes"]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-08-13T16:44:52.210Z"}, "credits": [{"lang": "en", "value": "tonghuaroot", "type": "reporter"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T17:14:51.911060Z", "id": "CVE-2026-58436", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T17:14:59.535Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gitea Open Source Git Server", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "1.26.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests"}], "id": "CVE-2026-58436", "lastModified": "2026-08-14T18:18:23.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58436", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T17:14:51.911060Z", "version": "2.0.3"}}]}, "published": "2026-08-13T17:17:27.600", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/gitea-1.27.0-is-released/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-1333"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests", "id": "2515473", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515473"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests", "A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumption and a Denial of Service (DoS) condition, making the service unavailable to legitimate users."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-58436", "package_state": [{"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines-client", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-cli-tkn-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-opc-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9", "product_name": "OpenShift Pipelines"}], "public_date": "2026-08-13T16:44:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58436\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58436\nhttps://blog.gitea.com/gitea-1.27.0-is-released/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3"], "statement": "This is an Important denial of service vulnerability in Gitea. An unauthenticated remote attacker can exploit a quadratic-time algorithm in the ParseAcceptLanguage function, leading to excessive resource consumption and service unavailability.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.26.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea Open Source Git Server", "source": "cna", "vendor": "Gitea"}, "product": "gitea_open_source_git_server", "vendor": "gitea"}], "created": "2026-08-13T18:45:04.410805+00:00", "updated": "2026-08-14T19:45:16.676328+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea_open_source_git_server"]}