The vulnerability originates in Daptin's LanguageMiddleware, which forwards raw Accept‑Language headers to a language parser without sanitizing underscore separators. Long sequences of underscore–separated language subtags longer than eight characters bypass the guard logic and trigger repeated buffer movements that consume CPU time quadratically. An attacker can send unauthenticated requests with a crafted header of up to 1 MiB, causing the server to spend minutes processing the header while also logging the entire payload, amplifying the denial‑of‑service cost. The impact is a denial of service that can saturate application CPU resources; normal HTTP responses may hide the abuse.

Daptin, the GraphQL/JSON‑API headless CMS, is affected in all releases prior to 0.12.26. The vulnerability resides in the global LanguageMiddleware component that parses Accept‑Language headers.

The CVSS score of 8.7 classifies this flaw as high severity. EPSS is not available, so the exploitation probability is uncertain, but the attack is remotely exploitable via unauthenticated HTTP requests to the public page or /api. The flaw is not listed in the CISA KEV catalog, yet the potential for rapid CPU amplification makes it a valuable target for attackers. The attack path requires no special privileges; the victim only needs to observe the affected service and send a crafted header.