High [CVE-2022-32149 +1] Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
This high-severity Red Hat Linux advisory covers CVE-2022-32149 and CVE-2026-49329 affecting Red Hat OpenShift Container Platform 4.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.
ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check.
An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users. This is an Important denial of service vulnerability in OpenShift Container Platform.
Unauthenticated remote attackers can exploit it by sending oversized Accept-Language headers to the OAuth server's login endpoints. This triggers a quadratic-time parsing process, consuming excessive CPU resources and potentially disrupting service availability.
The HAProxy ingress router, configured for TLS passthrough on OAuth routes, does not limit HTTP header sizes, allowing the malicious headers to reach the vulnerable component. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-407. Affected Red Hat products: Red Hat OpenShift Container Platform 4.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Apply a call-site guard in getPreferredLang() that counts both '-' and '_' separators and short-circuits to the English fallback when the total exceeds a small ceiling (e.g., 32). Alternatively, limit Accept-Language header size at a reverse proxy or WAF layer to 4 KiB or less.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.