Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language…
Priority MEDIUM 40CWE-407Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-407.
Summary
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00724 54th percentileScored 2026-11-07
Fix Fixed Red Hat: 8 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1791839120 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1791598539 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 1792883889 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 1790882323 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 1790611633 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | 1790702087 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | 1790707106 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | 1790713150 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | Not affected | CNA |
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1791839120 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1791598539 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 1792883889 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 1790882323 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 1790611633 Patch available CNA
- Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 1790702087 Patch available CNA
- Red Hat OpenShift Container Platform 4.21 VendorRed Hat Affected — Fixed in 1790707106 Patch available CNA
- Red Hat OpenShift Container Platform 4.22 VendorRed Hat Affected — Fixed in 1790713150 Patch available CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:openshift:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:openshift:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:openshift:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:openshift:4.21::el9 | 4.21 | — | Red Hat |
| cpe:/a:redhat:openshift:4.22::el9 | 4.22 | — | Red Hat |
| cpe:/a:redhat:openshift:5 | 5 | — | Red Hat |
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:openshift:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:openshift:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:openshift:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:openshift:4.21::el9 Versions 4.21 — ·Red Hat
- cpe:/a:redhat:openshift:4.22::el9 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat
Remediation
Red Hat 8 advisories
- RHSA-2026:89715 Released 2026-10-27 · Red Hat rating ImportantOpenShift Container Platform 4.16.74 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:82785 Released 2026-10-22 · Red Hat rating ImportantOpenShift Container Platform 4.14.76 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-baremetal-rhel8-operator +9
- RHSA-2026:82813 Released 2026-10-22 · Red Hat rating ImportantOpenShift Container Platform 4.15.70 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kube-metrics-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9 +23
Show 5 more Red Hat advisories
- RHSA-2026:79039 Released 2026-10-15 · Red Hat rating ImportantOpenShift Container Platform 4.18.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +18
- RHSA-2026:74434 Released 2026-10-07 · Red Hat rating ImportantOpenShift Container Platform 4.19.50 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +7
- RHSA-2026:74380 Released 2026-10-06 · Red Hat rating ImportantOpenShift Container Platform 4.20.41 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +12
- RHSA-2026:74429 Released 2026-10-06 · Red Hat rating ImportantOpenShift Container Platform 4.22.17 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel9 +15
- RHSA-2026:74383 Released 2026-10-06 · Red Hat rating ImportantOpenShift Container Platform 4.21.36 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +12
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:82785 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:82813 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:89715 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:79039 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:74434 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:74380 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:74383 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:74429 |
Not affected: 9 products
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-49329
- 2026-10-03 Alias added: GHSA-2mr2-j2wm-v93x
- 2026-10-06 Fix available: RHSA-2026:74429 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:74383 · Red Hat
- 2026-10-06 Fix available: Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22 · Red Hat
- 2026-10-06 Fix available: openshift4/ose-oauth-server-rhel9@1790707106, openshift4/ose-oauth-server-rhel9@1790713150 · CNA
- 2026-10-06 2 new references · CNA
- 2026-10-07 EPSS moved to the 50th–90th percentile
- 2026-10-07 Fix available: openshift4/ose-oauth-server-rhel9@1790702087 · CNA
- 2026-10-07 1 new reference · CNA
- 2026-10-07 Fix available: RHSA-2026:74380 · Red Hat
- 2026-10-07 Fix available: Red Hat OpenShift Container Platform 4.20 · Red Hat
- 2026-10-07 Fix available: openshift4/ose-oauth-server-rhel9@1790611633 · CNA
- 2026-10-07 1 new reference · CNA
- 2026-10-07 Fix available: RHSA-2026:74434 · Red Hat
- 2026-10-07 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat
- 2026-10-16 Fix available: openshift4/ose-oauth-server-rhel9@1790882323 · CNA
- 2026-10-16 1 new reference · CNA
- 2026-10-16 Fix available: RHSA-2026:79039 · Red Hat
- 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.18 · Red Hat
- 2026-10-23 Fix available: openshift4/ose-oauth-server-rhel8@1791839120, openshift4/ose-oauth-server-rhel9@1791598539 · CNA
- 2026-10-23 2 new references · CNA
- 2026-10-23 Fix available: RHSA-2026:82813 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:82785 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 · Red Hat
- 2026-10-29 Fix available: openshift4/ose-oauth-server-rhel9@1792883889 · CNA
- 2026-10-29 1 new reference · CNA
- 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.16 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89715 · Red Hat
- 2026-10-30 Affected versions changed · CNA
- 2026-10-30 Affected versions changed · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-49329 · CVE Program
- CVE-2026-49329 · NVD
- FIRST EPSS
- GHSA-2mr2-j2wm-v93x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-49329 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences