Bug 2483248 (CVE-2026-49329)

Summary: CVE-2026-49329 openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, security-response-team, sghai, sidsharm, suppawar, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-29 13:25:07 UTC
The getPreferredLang() function in pkg/server/locales/locales.go passes the raw Accept-Language header into golang.org/x/text/language.ParseAcceptLanguage() without input validation. The upstream CVE-2022-32149 mitigation counts only '-' characters (capped at 1000) but the BCP 47 scanner aliases '_' to '-' internally after the guard check. A 1 MiB Accept-Language header using '_' separators bypasses the guard, triggering quadratic-time parsing (~1 second CPU per request on Apple M1 Pro). The affected endpoints (/login, /oauth/authorize/error) are unauthenticated. The OAuth route uses TLS passthrough (termination: passthrough), so the HAProxy ingress router operates at L4 and does not limit HTTP header sizes — Go's default MaxHeaderBytes of 1 MiB applies. Call sites: pkg/server/login/login.go:134, pkg/server/errorpage/errorpage.go:33,50,97. go.mod pins golang.org/x/text v0.29.0.