Threats tagged 'ghsa-2mr2-j2wm-v93x'

A vulnerability in openshift/oauth-server allows an unauthenticated attacker to cause a denial of service by sending a crafted Accept-Language header with '_' separators. This triggers quadratic-time parsing in the golang.org/x/text/language.ParseAcceptLanguage() function, bypassing previous mitigations and consuming excessive CPU, resulting in denial of authentication service for all cluster users.