CVE-2026-59396: falha de média gravidade em Cloud Foundry UAA
DoS Vulnerability in UAA Related to JWKS URI Handling
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — Cloud Foundry UAA
No mesmo produto, das mais perigosas para as menos.
CVE-2018-15761CRITICALUAA Privilege EscalationEPSS 1.7%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%CVE-2019-3801HIGHJava Projects using HTTP to fetch dependenciesEPSS 0.6%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%CVE-2020-5402HIGHUAA fails to check the state parameter when authenticating with external IDPsEPSS 0.5%CVE-2026-59358HIGHUAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant typeEPSS 0.4%