CVE-2026-49329: Inefficient Algorithmic Complexity in Red Hat Red Hat OpenShift Container Platform 4.18
Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
CVSS v3.1
Score 7.5high
Affected software
Red Hat
Red Hat OpenShift Container Platform 4.18
Red Hat
Red Hat OpenShift Container Platform 4.19
Red Hat
Red Hat OpenShift Container Platform 4.20
Red Hat
Red Hat OpenShift Container Platform 4.21
Red Hat
Red Hat OpenShift Container Platform 4.22
Red Hat
Red Hat OpenShift Container Platform 4
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the openshift/oauth-server component of Red Hat OpenShift Container Platform 4.19. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without validating input. The mitigation for CVE-2022-32149 is bypassed because the upstream guard counts only '-' characters, but the internal BCP 47 scanner treats '_' as '-'. An attacker can craft an Accept-Language header with '_' separators to trigger quadratic-time parsing, resulting in excessive CPU usage and denial of authentication for all cluster users. Red Hat has released an advisory for OpenShift Container Platform 4.21.36 that addresses this issue among others.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to cause a denial of service by consuming excessive CPU resources on the OAuth server, preventing authentication for all cluster users. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Mitigation Recommendations
Red Hat has released a security update in OpenShift Container Platform 4.21.36 that fixes this vulnerability. Users are advised to upgrade to this version or later to remediate the issue. There is no indication that the vulnerability is mitigated without applying the update. Patch status is confirmed by the Red Hat advisory. Follow Red Hat's official upgrade instructions to fully apply the fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-05-29T13:24:26.096Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-49329","vendor":"Red Hat"}]
Threat ID: 6a96f4d7acd9273b49e7622a
Added to database: 09/01/2026, 15:52:55 UTC
Last enriched: 10/13/2026, 21:30:39 UTC
Last updated: 10/15/2026, 22:07:13 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.