Cloud Foundry UAA CVE-2026-59396

Exploitation requires that UAA use the private_key_jwt client-authentication mechanism with a remote jwks_uri that UAA fetches and caches. The attacker must first satisfy a privileged prerequisite - write access to client configuration (to point a jwks_uri at an oversized payload) or control of an already-trusted/compromised JWKS endpoint - which is why the vector is PR:H. Once the large object is cached, the triggering requests themselves are anonymous and require no authentication or user interaction. Limiting factors: the attack only affects availability (no data exposure or integrity loss), it is confined to deployments actually using private_key_jwt with remote JWKS, and the initial privileged access requirement meaningfully narrows who can set up the condition. The specific size threshold or object that triggers heap exhaustion is not detailed in the available sources.

This is a medium-severity, availability-only denial-of-service issue that the signals consistently describe as a moderate rather than urgent priority. The source CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:N/VI:N/VA:H) scores 6.9 and makes the picture clear: network-reachable and low-complexity, but gated behind high privileges (PR:H) and with no confidentiality or integrity impact - only availability (VA:H). The description reinforces this by stating the attacker needs prerequisites, namely write access to client configuration or a compromised JWKS endpoint, before the anonymous follow-on requests can force repeated deserialization. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the moderate score. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided in the input, so there is no evidence of active exploitation or published exploit code. The net picture is internally consistent: a genuine but contained DoS that depends on a privileged precondition, warranting scheduled remediation rather than emergency response. Note the input provides no CWE and no fixed-version data, so patch specifics must be confirmed with the Cloud Foundry advisory.

An attacker who already holds write access to UAA client registrations (or who controls a JWKS endpoint UAA trusts) configures a private_key_jwt client whose remote jwks_uri returns a very large JSON object, which UAA fetches and caches. The attacker then sends a stream of anonymous, invalid client-authentication requests, each of which forces UAA to fully deserialize and parse the oversized cached object, driving CPU to saturation and eventually triggering a Java OutOfMemoryError that takes the service offline. No public exploit code was identified in the provided data.