nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin
    i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls
    `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any
    size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed
    language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-`
    characters in the input at 1000, but it does not cap `_` characters even though the parser's internal
    scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language`
    header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-
    ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming
    ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue. (CVE-2026-61629)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin     i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls     `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any     size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed     language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-`     characters in the input at 1000, but it does not cap `_` characters even though the parser's internal     scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language`     header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-     ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming     ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue. (CVE-2026-61629)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
448254	SCA: security update for github.com/lucasdillmann/nginx-ignition (GHSA-jr34-h97m-9hpx)	Tenable Cloud Security	SCA Checks	Local	high
448254	SCA: security update for github.com/lucasdillmann/nginx-ignition (GHSA-jr34-h97m-9hpx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
349167	Linux Distros Unpatched Vulnerability : CVE-2026-61629	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-61629

high

Tenable Plugins

high

high

high