Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-49329

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift Container Platform 4.14

Default version status: affected

  • 1791839120 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.15

Default version status: affected

  • 1791598539 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.16

Default version status: affected

  • 1792883889 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.18

Default version status: affected

  • 1790882323 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.19

Default version status: affected

  • 1790611633 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.20

Default version status: affected

  • 1790702087 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.21

Default version status: affected

  • 1790707106 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.22

Default version status: affected

  • 1790713150 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: unaffected

References