CVE-2026-59396: Cloud Foundry UAA denial-of-service in private_key_jwt client-authentication

CVE-2026-59396 · Severity: medium · CVSS 4.9 · Published 2026-10-30

Cloud Foundry UAA is an identity and access management service used in enterprise environments. A denial-of-service vulnerability in its JWT client authentication mechanism allows attackers with specific access privileges to trigger excessive CPU usage and memory exhaustion, causing the service to become unavailable. An attacker exploiting this flaw can repeatedly force parsing of large cached authentication objects until the system runs out of memory.

Technologies: Cloud Foundry UAA. Vendors: Cloud Foundry.

Quick answers

Is CVE-2026-59396 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59396 being exploited in the wild.
How severe is CVE-2026-59396?
Medium severity, with a CVSS score of 4.9, published 30 October 2026.
Which products and versions are affected?
Cloud Foundry UAA v76.23.0 through v79.8.0.
Is there a fix for CVE-2026-59396?
Yes: fixed in UAA 79.9.0 or greater. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59396 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59396?
Check whether you run Cloud Foundry UAA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: UAA 79.9.0 or greater

Technical details

The vulnerability exists in UAA's handling of remote JWKS URI responses, which are cached server-side. When invalid authentication attempts are processed, the cached JWKS data undergoes full deserialization and object graph reconstruction. An attacker with write access to clients or control of a compromised endpoint can craft large JWKS payloads and then send anonymous authentication requests that repeatedly trigger parsing of the cached data, consuming CPU and heap memory until an OutOfMemoryError causes service unavailability. The attack requires elevated privileges to initially populate the cache, but subsequent attacks can be anonymous.

Affected products

  • Cloud Foundry UAA v76.23.0 through v79.8.0

Timeline

  • 2026-10-27: disclosed: Cloud Foundry Foundation Security Team advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.