nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61629 · Microsoft / collected KEV context

EUVD-2026-83924

GHSA-jr34-h97m-9hpx

GO-2026-6539

cve-program · CVE-2026-61629

• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
• https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
• https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485

euvd · EUVD-2026-83924

• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
• https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
• https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485

nvd · CVE-2026-61629

• https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
• https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485
• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx

osv · GHSA-jr34-h97m-9hpx

• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
• https://nvd.nist.gov/vuln/detail/CVE-2026-61629
• https://github.com/lucasdillmann/nginx-ignition/pull/125
• https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
• https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485
• https://github.com/lucasdillmann/nginx-ignition
• https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1

osv · GO-2026-6539

• https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx
• https://nvd.nist.gov/vuln/detail/CVE-2026-61629
• https://github.com/lucasdillmann/nginx-ignition/commit/0c988fc1277c7d291725e8373313f8486fa1b31a
• https://github.com/lucasdillmann/nginx-ignition/commit/cbaf0fc16ed873f7178a2ca9b0d00a696e44b485
• https://github.com/lucasdillmann/nginx-ignition/pull/125
• https://github.com/lucasdillmann/nginx-ignition/releases/tag/2.40.1

No related operational record is retained in the current change model.