Skip to content
Fencer Vulns
high 7.5

CVE-2026-49329 json

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

published 2026-09-01 2 mo ago modified 2026-10-30 10 d ago also EUVD-2026-69301

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.14 1791839120
  • Red Hat Red Hat OpenShift Container Platform 4.15 1791598539
  • Red Hat Red Hat OpenShift Container Platform 4.16 1792883889
  • Red Hat Red Hat OpenShift Container Platform 4.18 1790882323
  • Red Hat Red Hat OpenShift Container Platform 4.19 1790611633
  • Red Hat Red Hat OpenShift Container Platform 4.20 1790702087
  • Red Hat Red Hat OpenShift Container Platform 4.21 1790707106
  • Red Hat Red Hat OpenShift Container Platform 4.22 1790713150

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-49329 updated cvss 7.5

openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints

  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-oauth-server-rhel8 1791839120
    fixed: vendor fix RHSA-2026:82785
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-oauth-server-rhel9 1791598539
    fixed: vendor fix RHSA-2026:82813
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-oauth-server-rhel9 1792883889
    fixed: vendor fix RHSA-2026:89715
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-oauth-server-rhel9 1790882323
    fixed: vendor fix RHSA-2026:79039
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-oauth-server-rhel9 1790611633
    fixed: vendor fix RHSA-2026:74434
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-oauth-server-rhel9 1790702087
    fixed: vendor fix RHSA-2026:74380
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-oauth-server-rhel9 1790707106
    fixed: vendor fix RHSA-2026:74383
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-oauth-server-rhel9 1790713150
    fixed: vendor fix RHSA-2026:74429
show 1 more
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1791838793, openshift4/ose-pod 1791842699, openshift4/ose-tests 1791781968, openshift4/ose-console 1791842061, openshift4/ose-coredns 1791842976, openshift4/ose-deployer 1791843620, +189 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1791878476, openshift4/ose-tests 1791889482, openshift4/ose-console 1791836468, openshift4/ose-deployer 1791888334, openshift4/ose-installer 1791889788, openshift4/ose-pod-rhel9 1791639781, +184 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1792881772, openshift4/ose-pod-rhel9 1792881268, openshift4/ose-sdn-rhel9 1792891515, openshift4/ose-etcd-rhel9 1792884751, openshift4/ose-tests-rhel9 1792892635, openshift4/ose-tools-rhel9 1792881835, +182 more Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1790826545, openshift4/ose-cli-rhel9 1790882345, openshift4/ose-pod-rhel9 1790853956, openshift4/ose-etcd-rhel9 1791320060, openshift4/ose-tests-rhel9 1791373456, openshift4/ose-tools-rhel9 1791372072, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1790609925, openshift4/ose-cli-rhel9 1790627931, openshift4/ose-pod-rhel9 1790610735, openshift4/ose-etcd-rhel9 1790610190, openshift4/ose-tests-rhel9 1790738839, openshift4/ose-tools-rhel9 1790737528, +180 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1790702743, openshift4/ose-cli-rhel9 1790701502, openshift4/ose-pod-rhel9 1790705159, openshift4/ose-etcd-rhel9 1790703604, openshift4/ose-tests-rhel9 1790707913, openshift4/ose-tools-rhel9 1790703780, +182 more
    +3 more products
    Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1790703737, openshift4/ose-cli-rhel9 1790702464, openshift4/ose-pod-rhel9 1790704469, openshift4/ose-etcd-rhel9 1790706697, openshift4/ose-tests-rhel9 1790708632, openshift4/ose-tools-rhel9 1790704750, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1790741595, openshift4/ose-cli-rhel9 1790712167, openshift4/ose-pod-rhel9 1790723524, openshift4/ose-etcd-rhel9 1790712437, openshift4/ose-tests-rhel9 1790726162, openshift4/ose-tools-rhel9 1790712958, +182 more Red Hat OpenShift Container Platform 5 openshift5/ose-oauth-server-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.