Denial-of-Service Vulnerability in UAA's Client-Authentication Mechanism affecting Cloud Foundry

CVE-2026-59396

What is CVE-2026-59396?

A vulnerability in UAA's private_key_jwt client-authentication mechanism allows for denial-of-service attacks. This occurs when UAA caches responses from a remote JWKS URI. If an attacker, possessing write access to clients or leveraging a compromised endpoint, sends multiple anonymous requests, it can lead to repeated parsing of large cached objects. This behavior may inflate CPU usage significantly and can result in Java heap space exhaustion, causing service outages.

References