CVE-2026-49329High· 7.5▾ TwilightA flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-3…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
openshift4/ose-oauth-server-rhel8 (all versions)openshift4/ose-oauth-server-rhel9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92091Medium· 5.9A flaw was found in jwcrypto
CVE-2026-73643High· 7.5js-yaml is a JavaScript YAML parser and dumper
CVE-2026-70453High· 7.5rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list
CVE-2026-81722High· 7.5nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing (CVE-2026-81722)
CVE-2026-45822High· 7.5decode-uri-component: decode-uri-component: Denial of Service via crafted input (CVE-2026-45822)
CVE-2026-71491High· 7.5sqlparse is a non-validating SQL parser module for Python