CVE-2026-49329: OpenShift OAuth Server DOS Vulnerability

CVE-2026-49329 Overview

A flaw in the openshift/oauth-server component allows unauthenticated attackers to trigger a denial of service against OpenShift cluster authentication. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header directly to golang.org/x/text/language.ParseAcceptLanguage() without input validation. This exposes a bypass of the mitigation for [CVE-2022-32149], allowing crafted headers to trigger quadratic-time parsing. Successful exploitation consumes excessive CPU on the OAuth server and blocks authentication for all cluster users. The weakness is tracked as [CWE-407] (Inefficient Algorithmic Complexity).

Critical Impact
An unauthenticated network attacker can deny authentication cluster-wide by sending a single crafted HTTP header.

Affected Products

Red Hat OpenShift Container Platform (openshift/oauth-server)
Deployments consuming golang.org/x/text/language via the OAuth server component
OpenShift OAuth login and error page endpoints

Discovery Timeline

2026-09-01 - CVE-2026-49329 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-49329

Vulnerability Analysis

The OpenShift OAuth server exposes login and error page endpoints that accept an Accept-Language HTTP header from unauthenticated clients. The server passes this header value to golang.org/x/text/language.ParseAcceptLanguage() without sanitizing the input. The upstream library implements a guard that counts - characters to bound parsing work. That guard fails to account for BCP 47 tag normalization performed later in the scanner.

The internal scanner aliases underscore (_) separators to hyphen (-) after the guard check completes. An attacker submits a tag using _ separators to evade the length guard while still expanding into a parseable BCP 47 tag with many subtags. The parser then executes with quadratic-time complexity relative to subtag count.

Root Cause

The root cause is a bypass of the mitigation introduced for [CVE-2022-32149]. The guard in ParseAcceptLanguage() inspects the raw input for - separators before normalization. Because underscore-to-hyphen aliasing occurs inside the scanner after the guard, an input that appears short and cheap to parse becomes expensive during actual tokenization. This is an algorithmic complexity flaw compounded by unsafe trust of client-supplied headers on unauthenticated endpoints.

Attack Vector

An attacker sends an HTTP request to an OpenShift OAuth login or error page endpoint with a crafted Accept-Language header containing many _-separated subtags. No authentication or user interaction is required. Repeated requests exhaust CPU capacity on the OAuth server, blocking authentication for legitimate users across the cluster. See the Red Hat CVE-2026-49329 Advisory for full technical detail.

No verified public exploit code is available at the time of writing. Refer to the Red Hat Bug Report #2483248 for reproduction context.

Detection Methods for CVE-2026-49329

Indicators of Compromise

HTTP requests to OAuth login or error page endpoints containing Accept-Language headers with unusually long values or many _ separators.
Sustained high CPU utilization on the oauth-server pod without a corresponding increase in successful authentication events.
Elevated request latency and timeouts on /oauth/authorize and related OAuth endpoints.
Cluster users reporting inability to log in while the OAuth service remains reachable.

Detection Strategies

Inspect ingress and OAuth server access logs for Accept-Language header values exceeding a reasonable length threshold (for example, 100 characters) or containing repeated _ characters.
Correlate oauth-server CPU spikes with request volume against login and error endpoints from a small set of source IPs.
Alert on authentication failure rate anomalies and OAuth endpoint 5xx or timeout counts.

Monitoring Recommendations

Ship oauth-server pod metrics and access logs to a centralized analytics platform for baseline and anomaly analysis.
Track per-source-IP request rates against /oauth/* endpoints and rate-limit outliers.
Monitor Go runtime CPU and garbage collection metrics on the OAuth server to detect algorithmic-complexity abuse early.

How to Mitigate CVE-2026-49329

Immediate Actions Required

Apply the vendor patch referenced in the Red Hat CVE-2026-49329 Advisory as soon as it is available for your OpenShift version.
Restrict network exposure of the OAuth server to trusted sources where operationally feasible.
Deploy web application firewall or ingress rules to reject Accept-Language headers containing _ separators or exceeding a strict length limit.
Rate-limit unauthenticated requests to OAuth login and error page endpoints.

Patch Information

Red Hat tracks remediation under the advisory linked above. The upstream fix requires the golang.org/x/text/language guard to normalize separators before counting, or the openshift/oauth-server code to validate the Accept-Language header before invoking ParseAcceptLanguage(). Confirm your OpenShift build includes the fixed component version listed in the Red Hat advisory before closing the finding.

Workarounds

Configure the cluster ingress or a reverse proxy to strip or normalize the Accept-Language header on requests to OAuth endpoints.
Enforce a maximum Accept-Language header length and reject values containing _ characters at the edge.
Apply per-IP connection and request rate limits to the OAuth service to blunt CPU exhaustion attempts.
Scale OAuth server replicas temporarily to absorb load while patching, recognizing this does not remove the vulnerability.

bash

# Configuration example: reject abusive Accept-Language headers at ingress (HAProxy syntax)
http-request deny deny_status 400 if { req.hdr(accept-language) -m len gt 100 }
http-request deny deny_status 400 if { req.hdr(accept-language) -m sub _ }