Severity
– 6.9 (Medium) CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
– 4.9 (Medium) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Versions Affected
UAA
– UAA versions from v76.23.0 thru v79.8.0
Description
A Denial of Service (DoS) vulnerability exists within UAA’s private_key_jwt client-authentication path related to the handling and caching of remote JWKS URIs.
When UAA fetches a remote jwks_uri, it stores the response body in cache, subsequent authentication attempts that are ultimately invalid may trigger the full deserialization and object graph reconstruction of this cached body.
An attacker who can fulfill a prerequisite (e.g., by having write access to clients or utilizing a compromised endpoint to establish the large JWKS entry in the singleton cache) can then use anonymous requests. Each request attempts to parse the large cached body into an object graph needed for validation, leading to excessive CPU utilization and ultimately exhausting the Java application heap space via java.lang.OutOfMemoryError (OOM), resulting in service unavailability.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below:
The Cloud Foundry project recommends upgrading the following releases:
UAA
- Upgrade to version 79.9.0 or greater
CF-Deployment
- Upgrade to version 60.11.0 or greater
Credit
This issue was responsibly reported by Minseong Kim
History
October 27th, 2026
