A critical denial of service vulnerability in nginx-ignition permits unauthenticated remote attackers to exhaust CPU resources through specially crafted HTTP headers.

This flaw involves the improper handling of the Accept-Language header within the gin i18n middleware, which fails to limit the size or complexity of input. An unauthenticated attacker can exploit this by sending a crafted HTTP GET request containing a long string of underscore characters, triggering quadratic-time complexity in the underlying language parser.

The vulnerability poses a significant threat to service availability. By consuming excessive CPU cycles, a small number of concurrent requests can saturate server resources, leading to a complete denial of service for legitimate users. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent operational disruption and potential downtime of the nginx-ignition web interface.

Immediate Action: Upgrade to version 2.40.1 or later, which implements the necessary input filtering to prevent the resource exhaustion flaw.

Proactive Monitoring: Monitor server CPU utilization and inspect HTTP access logs for requests containing unusually large or malformed Accept-Language headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block HTTP requests with abnormally long or suspicious header values.

Public Exploit Available: Unknown

Given the ease with which this vulnerability can be exploited to cause a denial of service, administrators must prioritize updating to version 2.40.1. If an immediate patch is not feasible, implement strict request header size limits at the load balancer or reverse proxy level to mitigate the risk of resource exhaustion until the software can be updated.