Live › vulnerability › CVE-2026-59396
UAA, the Cloud Foundry identity service, caches remote JWKS responses used for private_key_jwt client authentication. Invalid login attempts can force repeated parsing of these large cached objects, burning CPU and possibly causing Java out-of-memory errors that take the service down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Teams running UAA, typically in Cloud Foundry or similar platforms, where clients authenticate with private_key_jwt and use a remote JWKS URI. The attacker needs write access to client configuration or control of a JWKS endpoint, so deployments without those paths are less exposed. Deployments that do not use private_key_jwt are unknown from the sources to be affected.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
This page as .md · .json · in your agent: get_signal("CVE-2026-59396")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.