The vulnerability arises when nginx-ignition 2.29.0 through 2.40.0 processes the raw Accept-Language header with golang.org/x/text/language.ParseAcceptLanguage without applying any size or shape limits. The parser exhibits quadratic-time behavior on long, malformed lists of language tags, causing a single unauthenticated GET request that uses a header composed of many '_' separators to consume roughly 2.4 seconds of CPU on a host. A similar CPU increase corresponds to about a 75‑fold amplification, and ten simultaneous attackers can saturate a ten‑core machine for the duration of the attack while also sending ~10 MiB/s of upstream traffic.

The affected product is lucasdillmann’s nginx‑ignition. Versions from 2.29.0 up to, but not including, 2.40.1 are vulnerable; the fix is incorporated in 2.40.1.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack does not require authentication or privileged access; an attacker simply sends a crafted Accept‑Language header in an HTTP GET request to trigger the quadratic parsing routine. Because no input validation is performed, the vulnerability can be exploited remotely from the internet, making it a practical vector for distributed denial‑of‑service.