VulnSocial

CVE-2026-61629Patch

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-23); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-23: 1Mentions · 2026-10-04: 1Mentions · 2026-10-13: 1Patch / Workaround · 2026-10-04: 1Patch / Workaround · 2026-10-13: 1Technical Details · 2026-09-23: 1Technical Details · 2026-10-04: 1Technical Details · 2026-10-13: 109-2310-0410-13
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-231
Disclosure1
2026-10-041
Patch1
2026-10-131
Patch1
Full discourse3 posts
  • Ryx@PadhiyarRushi
    Disclosure

    nginx ignition unauth admin account creation via race! CVE-2026-61628: onboarding race condition allows unauthenticated admin account creation. Companion issue CVE-2026-61629 is an Accept-Language header parser bypass enabling ~75x CPU amplification. Fresh disclosures worth checking if you run the project. https://vulnso.com/vuln/nginx-ignition-has-unauthenticated-admin-account-creation-via-onboarding-race-condition #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #RCE

    Post summary

    The post announces two newly disclosed CVEs (CVE-2026-61628 and CVE-2026-61629) affecting nginx ignition, detailing an unauthenticated admin account creation via race condition and a CPU amplification via Accept-Language header bypass, with a link for further details.

    000148931
    954 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-61629 nginx ignition 2.29.0-2.40.0: DoS via quadratic-time Accept-Language parsing, CVSS 7.5. Patch under review, so mitigate by capping header size now. Details: https://www.valtersit.com/cve/CVE-2026-61629 #CVE #infosec #nginx #nginx #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The post describes a DoS vulnerability caused by quadratic-time Accept-Language parsing and provides a specific mitigation: cap header size. A patch is under review.

    0000044
    1.1K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-61629 (CVSS 7.5) affects nginx-ignition v2.29.0-2.40.0. Unauthenticated DoS via malformed Accept-Language header causes quadratic-time CPU exhaustion. Patch to v2.40.1 immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/jAj09zkYja

    Post summary

    This tweet announces an unauthenticated DoS vulnerability in nginx-ignition (CVE-2026-61629) with a CVSS score of 7.5, affecting versions 2.29.0 through 2.40.0, and recommends patching to v2.40.1 immediately.

    0000040
    146 followersView on X

Explore more

Back to dashboard