)]}'
{
  "commit": "972f2683e8864ae75860c0da80ef7c4c5a7cdee8",
  "tree": "c41bac3218d627081bd83d56586713f2602eefe0",
  "parents": [
    "367ce9e9df3a5c6a35d013826e306c82da64bd6a"
  ],
  "author": {
    "name": "tonghuaroot",
    "email": "tonghuaroot@gmail.com",
    "time": "Wed May 27 01:27:44 2026 +0000"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Wed Oct 21 09:26:16 2026 -0700"
  },
  "message": "language: count \u0027_\u0027 alongside \u0027-\u0027 in ParseAcceptLanguage guard\n\nThe BCP 47 scanner aliases \u0027_\u0027 to \u0027-\u0027 in scanner.init at\ninternal/language/parse.go lines 104-111, so a payload built\nwith \u0027_\u0027 as the separator bypasses the 1000-dash guard at\nlanguage/parse.go:169 (the CVE-2022-32149 fix landed in CL\n442235) and re-triggers the O(N^2) gobble path on\nattacker-controlled Accept-Language input. Count both\nseparators in the guard.\n\nReproduction summary:\n\n  100k tokens with \u0027_\u0027 separator:  1.35 s parse time\n  Same 100k tokens with \u0027-\u0027:       49.9 us (guard fires)\n  Amplification: ~27,000x\n\nSee golang/go#79684 for the full reproducer with go.mod,\nmain.go, and measurement output.\n\nTest:\n\nTestParseAcceptLanguageUnderscoreGuard in language/parse_test.go\nasserts errTagListTooLarge is returned when 1001 \u0027_\u0027 separators\nare present.\n\nFiled per the upstream invitation from the Go Security Officers:\nthe original security@golang.org report was determined to be not\na security issue, with an invitation to file as an upstream\nchange.\n\nFixes golang/go#79684\n\nChange-Id: I4e9a582c54a3e7268072870c0b22a3a392cfa1f2\nGitHub-Last-Rev: 701c4da23913b82c62e71ade7c80d178f22d7b21\nGitHub-Pull-Request: golang/text#66\nReviewed-on: https://go-review.googlesource.com/c/text/+/783500\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "053336e28666f0000a1f5c4ded57e7d472ab2be8",
      "old_mode": 33188,
      "old_path": "language/parse.go",
      "new_id": "65b53b915bb26948e31581d838377276a322ce26",
      "new_mode": 33188,
      "new_path": "language/parse.go"
    },
    {
      "type": "modify",
      "old_id": "0eee033e66fc18de2e3eca752840fafbf6e9ae9b",
      "old_mode": 33188,
      "old_path": "language/parse_test.go",
      "new_id": "189b24f1f623584c78480ff4e254ebab7418971a",
      "new_mode": 33188,
      "new_path": "language/parse_test.go"
    }
  ]
}