Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Published: 2026-09-01
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the OpenShift OAuth server allows an unauthenticated attacker to send a crafted Accept‑Language header that contains underscore separators, bypassing the upstream guard that only counts hyphens. The underlying BCP 47 parser interprets underscores as hyphens after the guard, triggering a quadratic‑time parsing algorithm. The resulting excessive CPU consumption can deny authentication for all cluster users, compromising availability without requiring any privileged access. The weakness corresponds to CWE‑407, a mismatch between safeguard logic and the malformed input processing routine.

Affected Systems

Red Hat OpenShift Container Platform 4 is affected. Current product versions include all 4.x releases until a patch is released; exact version ranges are not specified in the advisory.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so no concrete exploitation probability can be quoted, but the lack of input validation and the ability to trigger CPU‑intensive parsing make exploitation feasible from any external system that can reach the OAuth endpoints. The vulnerability is not listed in CISA KEV, yet its impact on cluster availability warrants immediate attention. The likely attack vector is an unauthenticated HTTP request to the OAuth login or error endpoints carrying a specially crafted Accept‑Language header.

Generated by OpenCVE AI on September 1, 2026 at 23:54 UTC.

Remediation

Vendor Workaround

Apply a call-site guard in getPreferredLang() that counts both '-' and '_' separators and short-circuits to the English fallback when the total exceeds a small ceiling (e.g., 32). Alternatively, limit Accept-Language header size at a reverse proxy or WAF layer to 4 KiB or less.

OpenCVE Recommended Actions

  • Implement the call‑site guard in getPreferredLang() that limits the total number of '-' and '_' separators to a small ceiling (e.g., 32) and defaults to the English fallback.
  • Configure a reverse proxy or WAF to cap the Accept‑Language header size at 4 KiB or less, preventing the quadratic parsing from being triggered.
  • Actively monitor oauth‑server CPU usage for sudden spikes and apply rate limiting or temporary throttling if such activity is detected.

Generated by OpenCVE AI on September 1, 2026 at 23:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Title Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
First Time appeared Redhat
Redhat openshift
Weaknesses CWE-407
CPEs cpe:/a:redhat:openshift:4
Vendors & Products Redhat
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Redhat Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-01T17:05:39.937Z

Reserved: 2026-05-29T13:24:26.096Z

Link: CVE-2026-49329

cve-icon Vulnrichment

Updated: 2026-09-01T17:05:28.400Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T16:16:57.760

Modified: 2026-09-01T21:03:04.987

Link: CVE-2026-49329

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-31T20:00:00Z

Links: CVE-2026-49329 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T00:00:06Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity