What’s Vulnerable › Vulnerabilities
CVE-2026-49329: Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-01 · updated 2026-10-30
- Weakness: CWE-407
Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Affected products
- Red Hat OpenShift Container Platform 4.18: all versions — fixed in 1790882323
- Red Hat OpenShift Container Platform 4.14: all versions — fixed in 1791839120
- Red Hat OpenShift Container Platform 4.15: all versions — fixed in 1791598539
- Red Hat OpenShift Container Platform 4.16: all versions — fixed in 1792883889
- Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1790611633
- Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1790702087
- Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1790707106
- Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1790713150
How to fix
Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 1790882323; Red Hat OpenShift Container Platform 4.14 1791839120; Red Hat OpenShift Container Platform 4.15 1791598539; Red Hat OpenShift Container Platform 4.16 1792883889; Red Hat OpenShift Container Platform 4.19 1790611633; Red Hat OpenShift Container Platform 4.20 1790702087; Red Hat OpenShift Container Platform 4.21 1790707106; Red Hat OpenShift Container Platform 4.22 1790713150. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2026:74380
- https://access.redhat.com/errata/RHSA-2026:74383
- https://access.redhat.com/errata/RHSA-2026:74429
- https://access.redhat.com/errata/RHSA-2026:74434
- https://access.redhat.com/errata/RHSA-2026:79039
- https://access.redhat.com/errata/RHSA-2026:82785
- https://access.redhat.com/errata/RHSA-2026:82813
- https://access.redhat.com/errata/RHSA-2026:89715
- https://access.redhat.com/security/cve/CVE-2026-49329
- https://bugzilla.redhat.com/show_bug.cgi?id=2483248
Get alerted when CVE-2026-49329 or the next vulnerability affects your stack