Executive brief
Red Hat OpenShift's OAuth server, which handles user authentication for Kubernetes clusters, is vulnerable to a denial-of-service attack through the Accept-Language HTTP header. An unauthenticated attacker can send a specially crafted header that triggers expensive CPU-intensive parsing, consuming cluster resources and preventing legitimate users from logging in. This vulnerability affects authentication availability across the entire cluster without requiring any special privileges or authentication.
Technical details
The vulnerability is a quadratic-time algorithmic complexity flaw (CWE-407) in OpenShift's OAuth login and error page endpoints. The code passes the unauthenticated Accept-Language header directly to golang.org/x/text/language.ParseAcceptLanguage() without validation. An earlier CVE-2022-32149 mitigation guard counts only '-' characters but does not account for '_' separators, which the internal BCP 47 scanner aliases to '-' after the guard check. An attacker can craft an Accept-Language header using '_' separators instead of '-' to bypass the guard and trigger quadratic-time parsing. The attack is network-reachable and requires no authentication or user interaction; HAProxy's TLS passthrough mode on OAuth routes does not limit header sizes, allowing malicious headers to reach the vulnerable endpoint. Successful exploitation causes excessive CPU consumption, denying service to all cluster users.
Affected products
- Red Hat OpenShift <UNKNOWN>
Timeline
- 2026-09-01: disclosed