CVE-2026-49329: Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Other sources
The getPreferredLang() function in pkg/server/locales/locales.go passes the raw Accept-Language header into golang.org/x/text/language.ParseAcceptLanguage() without input validation. The upstream CVE-2022-32149 mitigation counts only '-' characters (capped at 1000) but the BCP 47 scanner aliases '' to '-' internally after the guard check. A 1 MiB Accept-Language header using '' separators bypasses the guard, triggering quadratic-time parsing (~1 second CPU per request on Apple M1 Pro). The affected endpoints (/login, /oauth/authorize/error) are unauthenticated. The OAuth route uses TLS passthrough (termination: passthrough), so the HAProxy ingress router operates at L4 and does not limit HTTP header sizes — Go's default MaxHeaderBytes of 1 MiB applies. Call sites: pkg/server/login/login.go:134, pkg/server/errorpage/errorpage.go:33,50,97. go.mod pins golang.org/x/text v0.29.0.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
golang.org/x/textto a version that resolves this vulnerability.Fixed in v0.29.0 - Configuration
Since TLS passthrough keeps header handling inside Go and Go's default MaxHeaderBytes of 1 MiB applies, reduce the effective maximum HTTP header size so a crafted 1 MiB Accept-Language header cannot reach ParseAcceptLanguage() on unauthenticated endpoints (/login and /oauth/authorize/error).
HAProxy ingress router (L4 TLS passthrough) / Go server MaxHeaderBytes = 1 MiB - Configuration
Add input validation before calling golang.org/x/text/language.ParseAcceptLanguage() in getPreferredLang() (pkg/server/locales/locales.go) for the raw unauthenticated Accept-Language header passed through from pkg/server/login/login.go:134 and pkg/server/errorpage/errorpage.go:33,50,97. Specifically, reject or cap Accept-Language values that use '_' separators that bypass the upstream CVE-2022-32149 guard behavior.
getPreferredLang() in pkg/server/locales/locales.go Accept-Language input validation = reject or truncate - Compensating control
Add an external compensating control at the network edge to limit HTTP header sizes even when OAuth login routes use TLS passthrough (termination: passthrough), since the HAProxy ingress router operates at L4 and does not limit HTTP header sizes.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to send requests to the OAuth server's /login or /oauth/authorize/error endpoints can attempt exploitation. No credentials or user interaction are required.
What request characteristic triggers the denial of service?
The attacker supplies a crafted, very large Accept-Language header using underscore separators. Underscores bypass the upstream mitigation's hyphen-count check before being treated internally as hyphens during parsing.
What is the operational impact?
Parsing the crafted header consumes excessive CPU in quadratic time. Repeated requests can deny authentication service to cluster users.
How can I determine whether traffic is attempting exploitation?
Inspect requests to /login and /oauth/authorize/error for unusually large Accept-Language headers, particularly values containing many underscore-separated language-tag components. Correlate those requests with elevated OAuth server CPU use and authentication disruption.