VYPR
← All advisories
High severityNVD Advisory· Published Oct 14, 2022· Updated May 15, 2025

Denial of service via crafted Accept-Language header in golang.org/x/text/language

CVE-2022-32149

Description

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Crafting a malicious Accept-Language header can cause Go's ParseAcceptLanguage to consume excessive CPU, leading to denial of service.

The vulnerability lies in the ParseAcceptLanguage function within Go's golang.org/x/text/language package. The function lacks input validation on the length of the Accept-Language header, allowing a specially crafted string to cause excessive CPU consumption during parsing[3].

An attacker can trigger this by sending an HTTP request with a crafted Accept-Language header containing a large number of subtags or repeated patterns. No authentication is required, and the attack is remote[1].

The impact is a denial of service condition, as the target server may become unresponsive due to high CPU usage while processing the malicious header[3].

A fix was committed to the golang.org/x/text repository that rejects Accept-Language headers with more than 1000 subtags[4]. The fix is included in Go 1.18.6 and Go 1.19.1. Users should upgrade to these versions or apply the patch to the x/text package[3].

References
  1. NVD - CVE-2022-32149
  2. GO-2022-1059 - Go Packages
  3. language: reject excessively large Accept-Language strings · golang/text@434eadc

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/textGo
< 0.3.80.3.8

Affected products

199

Patches

1
434eadcdbc3b

language: reject excessively large Accept-Language strings

https://github.com/golang/textRoland ShoemakerSep 2, 2022via ghsa
commit
2 files changed · +18 −0
  • language/parse.go+5 −0 modified
    @@ -147,6 +147,7 @@ func update(b *language.Builder, part ...interface{}) (err error) {
 }
 
 var errInvalidWeight = errors.New("ParseAcceptLanguage: invalid weight")
+var errTagListTooLarge = errors.New("tag list exceeds max length")
 
 // ParseAcceptLanguage parses the contents of an Accept-Language header as
 // defined in http://www.ietf.org/rfc/rfc2616.txt and returns a list of Tags and
@@ -164,6 +165,10 @@ func ParseAcceptLanguage(s string) (tag []Tag, q []float32, err error) {
 		}
 	}()
 
+	if strings.Count(s, "-") > 1000 {
+		return nil, nil, errTagListTooLarge
+	}
+
 	var entry string
 	for s != "" {
 		if entry, s = split(s, ','); entry == "" {
  • language/parse_test.go+13 −0 modified
    @@ -394,3 +394,16 @@ func TestParseAcceptLanguage(t *testing.T) {
 		}
 	}
 }
+
+func TestParseAcceptLanguageTooBig(t *testing.T) {
+	s := strings.Repeat("en-x-a-", 333)
+	_, _, err := ParseAcceptLanguage(s)
+	if err != language.ErrSyntax {
+		t.Errorf("ParseAcceptLanguage() unexpected error: got %v, want %v", err, language.ErrSyntax)
+	}
+	s += "en-x-a"
+	_, _, err = ParseAcceptLanguage(s)
+	if err != errTagListTooLarge {
+		t.Errorf("ParseAcceptLanguage() unexpected error: got %v, want %v", err, errTagListTooLarge)
+	}
+}

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.