CVE-2026-59396

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

• CWE-400

• https://www.cloudfoundry.org/blog/cve-2026-59396-dos-vulnerability-in-uaa-related-to-jwks-uri-handling-2/

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5938Improper control flow management allows a crafted document a…5.5
• CVE-2026-59385A user with SpaceDeveloper privileges could modify the URL o…2.7
• CVE-2026-59386A SpaceSupporter could improperly modify an application's st…6.5
• CVE-2026-59387The Nginx routing configuration for Cloud Controller blocks …8.8
• CVE-2026-59388Cloud Controller (CAPI) leaks sensitive data into audit logs…6.5
• CVE-2026-5939A crafted XFA PDF can trigger a use-after-free condition dur…5.5
• CVE-2026-5940Calling a function that triggers a UI refresh after removing…5.5
• CVE-2026-5941Parsing logic flaws cause non-signature data to be misidenti…7.1
• CVE-2026-5942Flaws in page lifecycle management allow document structure …5.5
• CVE-2026-5943Document structural anomalies caused inconsistencies between…7.8
• CVE-2026-5944An improper access control vulnerability exists in the Cisco…8.2
• CVE-2026-5946Multiple flaws have been identified in `named` related to th…7.5