Description

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T16:16:57.760Z",
  "pubdate": "2026-09-01T16:16:57.760Z",
  "executiveSummary": "A vulnerability in openshift/oauth-server allows for an unauthenticated denial-of-service (DoS) attack via resource exhaustion. The flaw arises from improper input validation of the Accept-Language HTTP header, which is passed to the golang.org/x/text/language.ParseAcceptLanguage() function.\nThis vulnerability constitutes a bypass of existing protections intended to prevent quadratic-time complexity issues, specifically circumventing the mitigation introduced for CVE-2022-32149. By leveraging specific character substitutions, an attacker can force the application to perform computationally expensive parsing operations, leading to excessive CPU consumption.\nThe vulnerability affects openshift/oauth-server and poses a critical risk to cluster availability. Because the attack targets the OAuth login and error page endpoints, which are exposed to unauthenticated traffic, an attacker can effectively lock out all users from accessing the cluster authentication services. Successful exploitation requires no authentication or special privileges, making it a significant concern for public-facing or multi-tenant OpenShift environments.",
  "technicalDetails": "The vulnerability is rooted in an insufficient input validation mechanism within the openshift/oauth-server codebase when handling the Accept-Language header. Specifically, the implementation attempts to mitigate the quadratic-time complexity issue identified in CVE-2022-32149 by pre-screening the header for hyphen characters ('-'), which are commonly used in BCP 47 language tags.\nThe flaw manifests because the upstream mitigation guard only checks for the presence of the '-' character, failing to account for the normalization behavior of the underlying golang.org/x/text/language package. The internal BCP 47 scanner treats the underscore character ('_') as an alias for a hyphen during the parsing process. Consequently, an attacker can bypass the guard check by substituting '-' with '_' in a crafted Accept-Language header string.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious Accept-Language header containing a long, repetitive, or specifically structured sequence of language tags separated by underscores. 2) The crafted header is sent to the /oauth/login or error page endpoints of the openshift/oauth-server. 3) The server's guard mechanism checks the input, fails to detect the forbidden '-' characters, and permits the header to pass through to the golang.org/x/text/language.ParseAcceptLanguage() function. 4) The library parses the input, normalizing the underscores to hyphens. 5) The parsing logic hits a worst-case computational path, resulting in quadratic-time complexity relative to the input size. 6) The resulting CPU spike consumes available compute resources on the server instance.\nThis behavior facilitates a Denial of Service attack where the OAuth server becomes unresponsive due to thread starvation or extreme CPU load. Since the affected endpoints are used for authentication, this effectively prevents all legitimate cluster users from logging in. The vulnerability is exploitable over the network by any unauthenticated actor. No elevated privileges are required, and the exploit does not depend on target-specific configuration, as it relies on the intrinsic behavior of the language parser library used by the product."
}