{"id":"CVE-2026-59396","title":"DoS Vulnerability in UAA Related to JWKS URI Handling","summary":"A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cac…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Cloud Foundry","product":"UAA","affected":["UAA >= 76.23.0 < 79.9.0","cf-deployment < 60.11.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:28:01.628068Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T20:10:01.484Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59396","references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-59396-dos-vulnerability-in-uaa-related-to-jwks-uri-handling-2/"}],"tags":["cve.org"],"epss":0.00287,"epssPercentile":0.21303,"ingestedAt":"2026-11-05T16:24:31.455Z","slug":"CVE-2026-59396","body":"## Overview\n\nA denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.\n\n## Affected\n\n- `UAA >= 76.23.0 < 79.9.0`\n- `cf-deployment < 60.11.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}