CVE-2026-49329 in OpenShift Container Platform
Summary
by MITRE • 09/01/2026
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in OpenShift's OAuth server represents a significant denial of service risk stemming from improper input validation within the language negotiation subsystem. Specifically, the endpoints responsible for handling OAuth login requests and error pages accept an unauthenticated Accept-Language header and pass it directly to the golang.org/x/text/language.ParseAcceptLanguage function without performing adequate sanitization or length checks. This design flaw allows any remote actor with network access to the authentication endpoint to influence the internal parsing logic of the Go standard library's internationalization package, creating a pathway for resource exhaustion attacks against the cluster's identity provider infrastructure.
The technical root cause lies in a bypass of previous mitigations applied for CVE-2022-32149. The upstream security fix implemented a guard mechanism that counted hyphen characters to limit processing time, assuming this would prevent quadratic-time complexity issues associated with BCP 47 language tag parsing. However, the internal scanner within the golang.org/x/text/language package normalizes underscores to hyphens after the initial guard check has already executed. Consequently, an attacker can construct a malicious Accept-Language header using underscore separators instead of hyphens. This crafted input evades the length-based counter because it contains no hyphens during the validation phase, yet triggers the same quadratic-time parsing behavior once the normalization occurs inside the parser.
The operational impact of this vulnerability is severe for OpenShift clusters relying on external OAuth providers or internal identity management systems. By sending a specifically crafted Accept-Language header with numerous underscore-separated language tags, an unauthenticated attacker can force the server to perform excessive computational work during every authentication attempt. This results in high CPU consumption that scales quadratically with the length of the input string. The resulting resource exhaustion effectively denies service to legitimate users, preventing them from authenticating and accessing cluster resources. Since this affects the login endpoint, it serves as a direct vector for disrupting core cluster availability without requiring any prior credentials or privileges.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to validate the structure and content of user-supplied data before processing. It also maps to CWE-787 Out-of-bounds Write in terms of resource consumption dynamics, though more accurately it falls under CWE-400 Uncontrolled Resource Consumption which leads to Denial of Service. In the context of the MITRE ATT&CK framework, this technique corresponds to T1496 Resource Hijacking, specifically through CPU exhaustion via algorithmic complexity attacks. The attack vector is classified as Network-based and requires no authentication, placing it in High severity due to its potential for widespread service disruption across all authenticated users within the affected OpenShift environment.
Mitigation strategies should focus on immediate patching of the underlying golang.org/x/text/language package or applying vendor-specific updates that address this specific bypass logic. Administrators must ensure their OpenShift clusters are updated with patches that enforce stricter input validation on the Accept-Language header, such as limiting its maximum length or rejecting headers containing characters not explicitly allowed in standard BCP 47 syntax prior to parsing. Additionally, implementing rate limiting at the network perimeter for authentication endpoints can help mitigate the impact of such attacks by throttling requests from single sources before they trigger significant resource consumption. Long-term remediation involves adopting input validation frameworks that normalize and validate headers against known safe patterns rather than relying on heuristic guards like character counting which are susceptible to normalization-based bypasses.