DoS Vulnerability in UAA Related to JWKS URI Handling

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• cloudfoundry.org/…rability-in-uaa-related-to-jwks-uri-handling-2 Diğer

Kayıt geçmişi

1. 30 Eki 2026 11:24Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-59387Broken access control restriction in Cloud Controller API
• 2,7 CVE-2026-59385Space Developer can extract space-scoped broker credentials
• 6,5 CVE-2026-59386Credential exposure to space supporter
• 7,5 CVE-2026-63341Aedes has Uncaught Exception and Uncontrolled Resource Consumption
• 5,5 CVE-2026-62250LibreDWG: unbounded allocation in pre-R13 DWG entity decoding
• 5,5 CVE-2026-62254LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing