CVE-2026-59396: medium-severity vulnerability in Cloud Foundry UAA
DoS Vulnerability in UAA Related to JWKS URI Handling
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Related CVEs — Cloud Foundry UAA
In the same product, most dangerous first.
CVE-2018-15761CRITICALUAA Privilege EscalationEPSS 1.7%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%CVE-2019-3801HIGHJava Projects using HTTP to fetch dependenciesEPSS 0.6%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%CVE-2020-5402HIGHUAA fails to check the state parameter when authenticating with external IDPsEPSS 0.5%CVE-2026-59358HIGHUAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant typeEPSS 0.4%