Vulnerability · Published Oct 30, 2026 · Assigned by vmware

CVE-2026-59396DoS Vulnerability in UAA Related to JWKS URI Handling

Medium 4.9

In plain English

A medium-severity uncontrolled resource consumption in cf-deployment from Cloud Foundry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

Affected products (as reported)

Vendor	Product	Versions
Cloud Foundry	UAA	76.23.0 – before 79.9.0
Cloud Foundry	cf-deployment	0 – before 60.11.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

https://www.cloudfoundry.org/blog/cve-2026-59396-dos-vulnerability-in-uaa-related-to-jwks-uri-handling-2/