CVE-2026-59396
Received Received - Intake

Denial-of-Service via JWKS Caching in UAA

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VMware

Description
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-59396
EUVD
EUVD-2026-113751

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Cloud Foundry UAA 76.23.0
Cloud Foundry cf-deployment 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59396 is a denial-of-service vulnerability in UAA's private_key_jwt client-authentication mechanism. It involves caching remote JWKS URIs and deserializing cached data during invalid authentication attempts. Attackers with prerequisites can force repeated parsing of large cached objects, causing high CPU usage and Java heap exhaustion, leading to service unavailability.

Detection Guidance

Monitor CPU and memory usage spikes during client authentication attempts. Check UAA logs for repeated deserialization errors or OutOfMemoryError messages. Use tools like jstack to analyze Java heap dumps for excessive object parsing.

Impact Analysis

This vulnerability can cause service outages by exhausting CPU and memory resources. If exploited, it may lead to system crashes or slowdowns, affecting availability for all users. Organizations using vulnerable UAA versions are at risk if attackers gain write access to clients or compromise endpoints.

Compliance Impact

This vulnerability can impact compliance with GDPR and HIPAA by causing service unavailability due to excessive CPU usage and potential Java heap exhaustion. Downtime may lead to disruptions in data processing or access, which could violate availability requirements under these regulations.

Mitigation Strategies

Upgrade UAA to version 79.9.0 or higher and CF-Deployment to version 60.11.0 or higher. Restrict write access to client configurations to prevent unauthorized JWKS modifications. Disable caching of remote JWKS URIs if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart