This vulnerability allows an unauthenticated attacker to trigger a quadratic‑time processing path in Ech0's i18n middleware by sending an excessively large Accept‑Language header. The header is passed unfiltered to the go‑i18n library, which parses language tags recursively; a header built from underscore separators can grow to the Go default 1MiB size and cause the parser to consume roughly 1.5 seconds of CPU per request. Because the middleware runs on every HTTP request, repeated requests can overconsume server resources, leading to denial of service. This represents a classic lack of input validation flaw (CWE‑400).

All installations of Ech0 prior to version 5.0.1 are susceptible to the issue. The CVE impacts every instance of the Ech0 application that processes the Accept‑Language header through its i18n middleware, regardless of deployment architecture.

The vulnerability carries a CVSS score of 8.7, indicating high severity, and has no recorded exploit probability in EPSS data; it is also not listed in the CISA KEV catalog. Attackers need only be able to send HTTP requests to reach the target, so unauthenticated exploitation is possible. By sending Accept‑Language headers up to 1 MiB in size, an attacker can consume about 1.5 seconds of CPU per request, and concurrent traffic can saturate a multi‑core server, effectively blocking legitimate traffic. The likely attack vector is through crafted HTTP requests sent directly to the application or via a relay such as a load balancer.