https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:03:23 +0000 https://vulnerability.circl.lu/vuln/cve-2026-49329 <p><strong>Affected:</strong> Red Hat OpenShift Container Platform 4</p> <p>A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only &#39;-&#39; characters but the internal BCP 47 scanner aliases &#39;_&#39; to &#39;-&#39; after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using &#39;_&#39; separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.</p> <p><strong>Affected:</strong> Red Hat OpenShift Container Platform 4</p> <p>A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only &#39;-&#39; characters but the internal BCP 47 scanner aliases &#39;_&#39; to &#39;-&#39; after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using &#39;_&#39; separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.</p> https://vulnerability.circl.lu/vuln/cve-2026-49329