AIKIDO-2026-10336

TL;DR

Affected versions of this package use a regular expression to split accept headers (e.g. Accept-Language) in the accept parsing utilities. A crafted header with many segments can trigger catastrophic backtracking and cause exponential CPU time, leading to denial of service. In proxy setups without header size limits, an attacker can send a malicious Accept-Language value that ties up the process for minutes. The patch replaces the regex-based split with a non-regex implementation to remove the ReDoS behavior.