CVE-2026-59396: DoS Vulnerability in UAA Related to JWKS URI Handling
A denial-of-service vulnerability exists in UAA's privatekeyjwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when UAA uses private_key_jwt client authentication with a remotely retrieved JWKS URI. Exploitation also requires an attacker to have write access to clients or to compromise an endpoint involved in serving the JWKS data.
Does an attacker need to remain authenticated to cause the denial of service?
No. After meeting the stated prerequisite, an attacker can send anonymous invalid authentication requests that repeatedly trigger parsing of large cached JWKS objects.
What operational impact can exploitation cause?
Repeated parsing can consume excessive CPU and exhaust the Java heap, potentially producing an OutOfMemoryError. This can make the UAA service unavailable.