CVE-2026-49329
Received Received - Intake

Accept-Language Header Parsing DoS in OpenShift OAuth Server

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-49329
EUVD
EUVD-2026-69301

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat openshift_oauth_server *
redhat openshift_container_platform 4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49329 is a Denial of Service (DoS) vulnerability in the openshift/oauth-server component. It allows an unauthenticated attacker to send a crafted Accept-Language header with underscores ('_') or spaces (' ') instead of hyphens ('-'), bypassing existing mitigations. This triggers inefficient parsing in golang.org/x/text/language.ParseAcceptLanguage(), consuming excessive CPU resources and disrupting authentication for all cluster users.

Detection Guidance

Monitor for unusually high CPU usage on systems running OpenShift OAuth server, particularly during authentication attempts. Check HTTP request logs for Accept-Language headers containing excessive underscores or spaces. Use network traffic analysis tools to detect large Accept-Language headers exceeding 4 KiB.

Impact Analysis

The vulnerability can cause severe service disruption by consuming excessive CPU resources, leading to denial of access for all users attempting to authenticate. Attackers can exploit it remotely without authentication, potentially making the entire OpenShift cluster unavailable.

Compliance Impact

This vulnerability primarily causes a denial of service (DoS) by consuming excessive CPU resources, which can disrupt service availability for all cluster users. While it does not directly expose or leak data, prolonged service disruption could impact compliance with regulations like GDPR (which requires availability of personal data processing systems) and HIPAA (which mandates timely access to protected health information).

Mitigation Strategies

Apply a patch to the getPreferredLang() function to count both hyphens and underscores in Accept-Language headers and enforce a small limit (e.g., 32). Alternatively, configure reverse proxies or WAFs to limit Accept-Language header size to 4 KiB or less. Monitor for ongoing attacks via CPU usage spikes or failed authentication attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49329. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart