---
id: CVE-2026-49329
title: >-
  Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via
  accept-language header underscore bypass on unauthenticated login endpoints
summary: >-
  A flaw was found in openshift/oauth-server. The OAuth login and error page
  endpoints pass the unauthenticated Accept-Language header to
  golang.org/x/text/language.ParseAcceptLanguage() without input validation. A
  bypass of the CVE-2022-3…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-407
vendor: Red Hat
product: openshift4/ose-oauth-server-rhel8
affected:
  - openshift4/ose-oauth-server-rhel8 (all versions)
  - openshift4/ose-oauth-server-rhel9 (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-01T17:05:19.987171Z'
published: '2026-09-01'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:32:11.841Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49329'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-49329'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2483248'
    label: RHBZ#2483248
tags:
  - cve.org
epss: 0.0063
epssPercentile: 0.47874
ingestedAt: '2026-09-18T13:41:41.660Z'
---

## Overview

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

## Affected

- `openshift4/ose-oauth-server-rhel8 (all versions)`
- `openshift4/ose-oauth-server-rhel9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available.