CyberRota Analysis
AI-GeneratedThe vulnerability exists in the OpenShift OAuth server, where the OAuth login and error page endpoints improperly handle the unauthenticated Accept-Language header, allowing an attacker to exploit this flaw. By sending a specially crafted header with '_' separators, an attacker can trigger excessive CPU consumption through quadratic-time parsing, leading to denial of service for all users attempting to authenticate. Organizations using OpenShift should prioritize addressing this vulnerability to prevent potential service disruptions.
Original NVD Description
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.