{"id":"CVE-2026-59396","kind":"vulnerability","aliases":["CVE-2026-59396"],"related":[],"title":"UAA: private_key_jwt login flaw lets anonymous requests exhaust server memory","description":"A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.","summary":"UAA, the Cloud Foundry identity service, caches remote JWKS responses used for private_key_jwt client authentication. Invalid login attempts can force repeated parsing of these large cached objects, burning CPU and possibly causing Java out-of-memory errors that take the service down.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-foundry","infrastructure","java","private-key-jwt","self-hosted","uaa"],"not_affected_if":["managed-hosting","no-private-key-jwt","no-remote-jwks"],"how_to_check":"- Check whether the deployment uses private_key_jwt client authentication with a remote JWKS URI on clients.\n- Check the UAA version in use against the fixed versions listed by the vendor: unknown from the sources.","fix":null,"status":"open","published_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","triaged_at":"2026-10-30T09:30:36+00:00","updated_at":"2026-10-30T09:30:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T09:30:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"UAA: private_key_jwt login flaw lets anonymous requests exhaust server memory","impact":"medium","summary":"UAA, the Cloud Foundry identity service, caches remote JWKS responses used for private_key_jwt client authentication. Invalid login attempts can force repeated parsing of these large cached objects, burning CPU and possibly causing Java out-of-memory errors that take the service down.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["uaa","cloud-foundry","java","private-key-jwt","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Service becomes unavailable through CPU exhaustion and Java heap OutOfMemoryError","analyst_note":"Find the fixed UAA versions and the affected version ranges from the NVD entry or the vendor advisory; sources here give neither.","how_to_check":"- Check whether the deployment uses private_key_jwt client authentication with a remote JWKS URI on clients.\n- Check the UAA version in use against the fixed versions listed by the vendor: unknown from the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["no-private-key-jwt","no-remote-jwks","managed-hosting"],"who_is_affected":"Teams running UAA, typically in Cloud Foundry or similar platforms, where clients authenticate with private_key_jwt and use a remote JWKS URI. The attacker needs write access to client configuration or control of a JWKS endpoint, so deployments without those paths are less exposed. Deployments that do not use private_key_jwt are unknown from the sources to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4200,"output_tokens":632,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59396':15A,18A 'access':120C 'anonym':8A,129C 'attack':116C 'attempt':51B,106C 'authent':48B,91C,105C 'burn':61B 'cach':38B,59B,101C,113C,137C 'caus':65B,139C 'client':47B,90C,122C 'client-authent':89C 'cloud':20B,34B 'cloud-foundri':19B 'compromis':125C 'cpu':62B,141C 'cve':13A,16A 'data':114C 'denial':78C 'denial-of-servic':77C 'deseri':110C 'endpoint':126C 'error':71B 'excess':140C 'exhaust':10A,147C 'exist':82C 'flaw':6A 'forc':53B,132C 'foundri':21B,35B 'full':109C 'heap':146C 'host':30B 'ident':36B 'infrastructur':22B 'invalid':49B,104C 'java':23B,66B,145C 'jwks':40B,98C 'jwt':4A,27B,46B,88C 'key':3A,26B,45B,87C 'larg':58B,136C 'let':7A 'login':5A,50B 'mechan':92C 'memori':12A,70B 'object':60B,138C 'out-of-memori':67B 'outofmemoryerror':149C 'pars':55B,134C 'possibl':64B 'potenti':144C 'prerequisit':118C 'privat':2A,25B,44B,86C 'private-key-jwt':24B 'remot':39B,97C 'repeat':54B,133C 'request':9A,130C 'respons':41B,103C 'result':150C 'retriev':95C 'self':29B 'self-host':28B 'send':128C 'server':11A 'servic':37B,75B,80C,152C 'take':73B 'trigger':108C 'uaa':1A,31B,32B,84C,94C 'unavail':153C 'uri':99C 'usag':142C 'use':42B 'via':148C 'vulner':81C 'write':119C","nicknames":[],"mitigations":[],"who_affected":"Teams running UAA, typically in Cloud Foundry or similar platforms, where clients authenticate with private_key_jwt and use a remote JWKS URI. The attacker needs write access to client configuration or control of a JWKS endpoint, so deployments without those paths are less exposed. Deployments that do not use private_key_jwt are unknown from the sources to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59396","severity":null,"published_at":"2026-10-30T09:17:15+00:00","modified_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","fetched_at":"2026-10-30T09:29:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}