High severity · published Sep 1, 2026
CVE-2026-49329
Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenShift Container Platform 4.14 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.15 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.18 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.19 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.20 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.21 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.22 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat OpenShift Container Platform 4.14
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49329
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:74380
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:74383
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:74429
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:74434
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:79039
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:82785
More from Red Hat OpenShift Container Platform 4.14
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in username
9.8
CVE-2026-43037
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
9.8
CVE-2026-4800
lodash vulnerable to Code Injection via `_.template` imports key names