CVE-2026-59396— DoS Vulnerability in UAA Related to JWKS URI Handling

Quick assessment

Affected

Cloud Foundry UAA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

UAA 的客户端认证机制中存在拒绝服务（DoS）漏洞。当 UAA 检索远程 JWKS（JSON Web Key Set）URI 时，会缓存其响应。无效的认证尝试可能触发对该缓存数据的完整反序列化操作。具备特定前提条件（如拥有客户端写权限或已遭入侵的端点）的攻击者可以发送匿名请求，强制系统重复解析大型缓存对象，从而导致 CPU 使用率异常升高，并可能因耗尽 Java 堆内存，最终造成服务不可用。

CVSS 4.9 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

DoS Vulnerability in UAA Related to JWKS URI Handling

Source: CVE Program / CVE List V5

Vulnerability Description

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Cloud Foundry	UAA	76.23.0 ~ 79.9.0	-
Cloud Foundry	cf-deployment	0 ~ 60.11.0	-

II. Public POCs for CVE-2026-59396

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-59396

请登录查看更多情报信息。

Other References for CVE-2026-59396 (1)

https://www.cloudfoundry.org/blog/cve-2026-59396-dos-vulnerability-in-uaa-related-to-jwks-uri-handling-2/

https://www.cve.org/CVERecord?id=CVE-2026-59396

Same Patch Batch · Cloud Foundry · 2026-10-30 · 4 CVEs total

CVE-2026-59387	8.8 HIGH	Broken access control restriction in Cloud Controller API
CVE-2026-59386	6.5 MEDIUM	Credential exposure to space supporter
CVE-2026-59385	2.7 LOW	Space Developer can extract space-scoped broker credentials

IV. Related Vulnerabilities

Same product: UAA

Same vendor: Cloud Foundry