CVE-2026-62160 - Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
CVE ID :CVE-2026-62160 Published : Oct. 30, 2026, 7:18 p.m. | 42 minutes ago Description :Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through...