Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Published: 2026-09-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via CPU exhaustion
Action: Apply Mitigation
AI Analysis

Impact

A flaw in the OpenShift OAuth server allows an unauthenticated attacker to send a crafted Accept‑Language header that contains underscore separators, bypassing the upstream guard that only counts hyphens. The underlying BCP 47 parser interprets underscores as hyphens after the guard, triggering a quadratic‑time parsing algorithm. The resulting excessive CPU consumption can deny authentication for all cluster users, compromising availability without requiring any privileged access. The weakness corresponds to CWE‑407, a mismatch between safeguard logic and the malformed input processing routine.

Affected Systems

Red Hat OpenShift Container Platform 4 is affected. Current product versions include all 4.x releases until a patch is released; exact version ranges are not specified in the advisory.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so no concrete exploitation probability can be quoted, but the lack of input validation and the ability to trigger CPU‑intensive parsing make exploitation feasible from any external system that can reach the OAuth endpoints. The vulnerability is not listed in CISA KEV, yet its impact on cluster availability warrants immediate attention. The likely attack vector is an unauthenticated HTTP request to the OAuth login or error endpoints carrying a specially crafted Accept‑Language header.

Generated by OpenCVE AI on September 1, 2026 at 23:54 UTC.

Remediation

Vendor Workaround

Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available.

OpenCVE Recommended Actions

  • Implement the call‑site guard in getPreferredLang() that limits the total number of '-' and '_' separators to a small ceiling (e.g., 32) and defaults to the English fallback.
  • Configure a reverse proxy or WAF to cap the Accept‑Language header size at 4 KiB or less, preventing the quadratic parsing from being triggered.
  • Actively monitor oauth‑server CPU usage for sudden spikes and apply rate limiting or temporary throttling if such activity is detected.

Generated by OpenCVE AI on September 1, 2026 at 23:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Vendors & Products Redhat openshift Container Platform

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Title Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
First Time appeared Redhat
Redhat openshift
Weaknesses CWE-407
CPEs cpe:/a:redhat:openshift:4
Vendors & Products Redhat
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Redhat Openshift Openshift Container Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-18T13:32:11.841Z

Reserved: 2026-05-29T13:24:26.096Z

Link: CVE-2026-49329

cve-icon Vulnrichment

Updated: 2026-09-01T17:05:28.400Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T16:16:57.760

Modified: 2026-09-01T21:03:04.987

Link: CVE-2026-49329

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-31T20:00:00Z

Links: CVE-2026-49329 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T16:27:43Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity