EUVD-2026-69301
GHSA-2mr2-j2wm-v93x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify publicly accessible OAuth login endpoint
-
DeliveryCraft Accept-Language header with underscore subtag separators
-
ExploitBypass CVE-2022-32149 hyphen-count guard
-
ExecutionTrigger O(n²) ParseAcceptLanguage() processing
-
PersistSaturate oauth-server CPU
-
ImpactAuthentication denied to all cluster users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | The OAuth login and error page endpoints must be network-reachable by the attacker - in standard OpenShift 4 deployments these endpoints are publicly accessible by design to enable user authentication, so no special network position is required for internet-facing clusters. No authentication is required: the Accept-Language header is processed before any credential check occurs. No non-default configuration is needed; the vulnerability is present in default OpenShift 4 deployments. The only practical limiting factor is network reachability: clusters that restrict OAuth endpoint access to internal networks or specific IP allowlists significantly reduce exposure. Sustained exploitation requires sending multiple requests to maintain CPU saturation, though the DoS can be triggered with a relatively small number of crafted requests given the quadratic parsing cost per request. |
| Impact | The CVSS 7.5 High vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately models the real-world risk. OAuth login endpoints are publicly accessible by design in standard OpenShift deployments, making every internet-facing cluster potentially exposed without any authentication prerequisite. Attack complexity is genuinely low: the bypass is deterministic and fully described - substituting '_' for '-' in Accept-Language values - requiring no environmental probing or brute force. The availability impact is disproportionately broad: because oauth-server is the authentication gateway, CPU saturation on this single component locks out all cluster users simultaneously, including developers, operators, and CI/CD pipelines. No CISA KEV listing and no confirmed POC moderate the immediate operational urgency somewhat, but the published bypass detail substantially reduces exploit development time compared to an undisclosed technique. EPSS data is absent from available intelligence. Clusters where OAuth endpoints are internet-accessible face elevated prioritization pressure. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a stream of HTTP requests to the cluster's publicly accessible OAuth login endpoint, each carrying an Accept-Language header such as 'en_US_Latn_001_foo_bar_baz_qux_...' with dozens of underscore-separated subtags. Each request bypasses the CVE-2022-32149 guard (which counts only '-' characters, finding none) and enters ParseAcceptLanguage(), where the BCP 47 scanner normalizes the underscores to hyphens and triggers quadratic-time processing. CPU on the oauth-server pod is rapidly saturated, rendering the authentication service unresponsive and simultaneously blocking all cluster users from logging in until the pod is restarted or the attack traffic is filtered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Quadratic-time CPU exhaustion in Red Hat OpenShift Container Platform 4's OAuth login and error page endpoints allows unauthenticated remote attackers to deny authentication to all cluster users simultaneously. The attack exploits a bypass of the CVE-2022-32149 mitigation in golang.org/x/text/language.ParseAcceptLanguage(): the existing guard checks for hyphen ('-') character counts, but the BCP 47 scanner internally aliases underscore ('_') to '-' after the guard executes, allowing a crafted Accept-Language header with underscore subtag separators to slip through and trigger unbounded quadratic-time parsing. No public exploit has been identified at time of analysis, though the bypass mechanism is fully documented in the CVE description, meaningfully lowering the bar to exploitation.
RemediationAI
Apply the Red Hat-released patch for OpenShift Container Platform 4 once available - the specific fixed version is not confirmed in the provided intelligence; monitor https://access.redhat.com/security/cve/CVE-2026-49329 and https://bugzilla.redhat.com/show_bug.cgi?id=2483248 for patch release and exact version information. As an immediate compensating control, deploy a WAF or reverse proxy in front of OAuth endpoints configured to reject or truncate Accept-Language headers exceeding a safe length threshold (e.g., 64-128 bytes) or containing excessive subtag counts; this will block malformed inputs before they reach ParseAcceptLanguage(), with the trade-off that overly aggressive rules could reject legitimate complex language tags. Rate-limiting unauthenticated requests to OAuth login and error endpoints reduces the sustained CPU impact of repeated attack attempts but does not prevent a single well-crafted header from consuming significant parsing time. Restricting network access to OAuth endpoints to known IP ranges - where operationally feasible - eliminates the network attack surface entirely and is the strongest interim control for clusters not requiring public-facing authentication.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is openshift/oauth-server, part of Red Hat OpenShift Container Platform 4 (CPE: cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*). OAuth login and error page endpoints accept the standard HTTP Accept-Language header from unauthenticated clients and forward it to golang.org/x/text/language.ParseAcceptLanguage() without sanitization or input length bounding. CWE-407 (Inefficient Algorithmic Complexity) is the root cause: the parser exhibits O(n²) time behavior on specially structured language tag inputs. CVE-2022-32149 previously addressed this function by introducing a guard that counts '-' subtag separators and rejects inputs exceeding a threshold. However, RFC 5646 (BCP 47) permits both '-' and '_' as subtag delimiters, and the golang.org/x/text internal BCP 47 scanner normalizes '_' to '-' after the guard has already evaluated the raw input - creating an alias-based bypass that the original guard was not designed to handle.
Know when Red Hat Openshift Container Platform 4 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OAuth login endpoints are public by design, no authentication required, underscore substitution is trivial; only availability is impacted with no confidentiality or integrity effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Executive ViewAI
Red Hat OpenShift Container Platform 4 contains a vulnerability that allows external attackers to disable cluster authentication by flooding OAuth endpoints with crafted requests, preventing all users from accessing the system. The attack requires no credentials and can be executed with minimal resources against any exposed cluster. Organizations running OSCP 4 face the risk of complete service unavailability if authentication infrastructure becomes overwhelmed.
Configure ingress or WAF to validate and block Accept-Language headers containing underscore characters in subtags; implement aggressive rate limiting on all OAuth endpoints; deploy request monitoring to detect patterns of malformed Accept-Language submissions; consider isolating OAuth infrastructure behind external DDoS mitigation services; enable cluster-level alerting for authentication service CPU spikes and HTTP 503 error rates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape th
Exploit-DB