CVE-2026-49329: Red Hat Openshift Container Platform 4

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

Affected products

• Red Hat Red Hat Openshift Container Platform 4
• Red Hat Red Hat Openshift Container Platform 4.19: before 1790611633 (fixed in 1790611633)
• Red Hat Red Hat Openshift Container Platform 4.20: before 1790702087 (fixed in 1790702087)
• Red Hat Red Hat Openshift Container Platform 4.21: before 1790707106 (fixed in 1790707106)
• Red Hat Red Hat Openshift Container Platform 4.22: before 1790713150 (fixed in 1790713150)

Published 2026-09-01. Last modified 2026-10-07.