CVE-2026-49329

CVE-2026-49329 is an unauthenticated algorithmic-complexity denial-of-service flaw (CWE-407) in the openshift/oauth-server component of Red Hat OpenShift. The OAuth login and error page endpoints forward the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without validation; the guard added for CVE-2022-32149 counts only '-' separators, but the library's internal BCP 47 scanner aliases '_' to '-' after that check, so underscore-separated tags bypass the length guard and trigger quadratic-time parsing. A single crafted request can exhaust CPU on the OAuth server, denying authentication to all users of the affected cluster, with no confidentiality or integrity impact (availability only, per the 7.5 CVSS score). Any OpenShift deployment running the vulnerable oauth-server is affected, especially clusters whose OAuth login route is reachable by untrusted network clients. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at just 0.4%.

What to do: Upgrade openshift/oauth-server to the patched release distributed by Red Hat as soon as it is available, since no specific fixed version is given in the advisory data. As interim mitigation, restrict or normalize the Accept-Language header at the ingress/router/L7 load balancer (e.g., strip the header or limit it to well-formed comma-separated language tags without underscores) and limit network exposure of the oauth-openshift route. Monitor CPU usage on the OAuth server pods for signs of parsing-related exhaustion.