diff --git a/components/api/api-security/src/main/java/org/eclipse/dirigible/components/api/security/UserFacade.java b/components/api/api-security/src/main/java/org/eclipse/dirigible/components/api/security/UserFacade.java
index d0ea5866a04..1d6d65bceda 100644
--- a/components/api/api-security/src/main/java/org/eclipse/dirigible/components/api/security/UserFacade.java
+++ b/components/api/api-security/src/main/java/org/eclipse/dirigible/components/api/security/UserFacade.java
@@ -399,7 +399,17 @@ public static String getLanguage() {
             if (language == null || language.isEmpty()) {
                 language = ANY_LANGUAGE;
             }
-            List<Locale.LanguageRange> ranges = Locale.LanguageRange.parse(language);
+            List<Locale.LanguageRange> ranges;
+            try {
+                ranges = Locale.LanguageRange.parse(language);
+            } catch (IllegalArgumentException e) {
+                // The header is client-controlled: a malformed value must degrade to "no language
+                // preference", never turn every localized read on this request into a 500.
+                if (logger.isWarnEnabled()) {
+                    logger.warn("Malformed Accept-Language header [{}] - ignoring it", language);
+                }
+                return "";
+            }
             return ranges == null || ranges.isEmpty() ? ""
                     : ranges.get(0)
                             .getRange();
diff --git a/components/engine/engine-document/src/main/java/org/eclipse/dirigible/components/engine/document/CmsStore.java b/components/engine/engine-document/src/main/java/org/eclipse/dirigible/components/engine/document/CmsStore.java
index 93370fc1e40..20288cf1cc9 100644
--- a/components/engine/engine-document/src/main/java/org/eclipse/dirigible/components/engine/document/CmsStore.java
+++ b/components/engine/engine-document/src/main/java/org/eclipse/dirigible/components/engine/document/CmsStore.java
@@ -95,7 +95,15 @@ List<String> listLanguages(String entityName) throws IOException {
         for (CmisObject child : printFolder.get()
                                            .getChildren()) {
             if (child instanceof CmisFolder) {
-                languages.add(child.getName());
+                // The S3 CMS names a child folder with its trailing separator (en/) while the
+                // internal CMS does not - normalize so the language CODE contract is backend-neutral.
+                String code = child.getName();
+                while (code.endsWith(PATH_SEPARATOR)) {
+                    code = code.substring(0, code.length() - 1);
+                }
+                if (!code.isEmpty()) {
+                    languages.add(code);
+                }
             }
         }
         return languages;