CVE-2026-59396
Medium
Description
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
SeverityMedium
CVSS4.9
Exploit probability—
ProductUAA
PublishedOct 30, 2026
First seenNov 4, 2026
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- Cloud Foundry UAA79.9.0 or later
- Cloud Foundry cf-deployment60.11.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Foundry UAA | 76.23.0 ≤ v < 79.9.0 | 79.9.0 |
| Cloud Foundry cf-deployment | v < 60.11.0 | 60.11.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.