Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global "LanguageMiddleware" in "server/language.go" passes the raw "Accept-Language" header from "LanguageMiddlewareFunc" through "GetLanguagePreference" to "golang.org/x/text/language.ParseAcceptLanguage" without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the "len <= 8" length check in "golang.org/x/text/internal/language/parse.go", causing repeated "gobble" operations to move the entire remaining buffer through "runtime.memmove". With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or "/api" can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. "resource.CheckErr" also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.