CVE-2026-59396 in UAA
Summary
by MITRE • 10/30/2026
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified within the User Account and Authentication UAA component specifically targets the private_key_jwt client-authentication mechanism during the retrieval and caching of remote JSON Web Key Sets JWKS URIs This security flaw stems from an improper handling of cached cryptographic material where invalid authentication attempts trigger a full deserialization process for data that has been previously stored in memory This behavior creates a significant resource consumption vector because the system does not adequately validate or limit the scope of objects being processed during this phase allowing malicious actors to exploit the underlying Java serialization mechanisms
An attacker who possesses write access to client configurations or controls a compromised endpoint can leverage this weakness by sending anonymous requests that force the repeated parsing and deserialization of large cached JWKS objects This action leads to excessive CPU usage as the system continuously attempts to process these malformed or oversized payloads The cumulative effect of such operations is severe memory pressure on the Java Virtual Machine JVM which ultimately results in heap exhaustion through an OutOfMemoryError exception When this threshold is reached the UAA service becomes unresponsive effectively causing a denial of service condition that disrupts authentication services for legitimate users and potentially impacts downstream dependent systems relying on valid token issuance
From a technical classification perspective this vulnerability aligns with CWE-502 Deserialization of Untrusted Data as it involves processing external input without sufficient validation or integrity checks Additionally the exploitation technique relates to ATT&CK T1496 Resource Hijacking where an adversary uses computing resources such as CPU and memory for their own benefit thereby degrading service availability for others The specific mechanism of forcing repeated parsing also touches upon CWE-787 Out-of-bounds Write if the deserialization process leads to buffer overflows though in this context the primary impact is resource exhaustion rather than code execution
Mitigation strategies should focus on implementing strict input validation and size limits for JWKS responses before they are cached or processed Furthermore developers should consider using safer serialization alternatives such as JSON-based formats instead of Java native serialization which is inherently vulnerable to these types of attacks Implementing rate limiting on authentication endpoints can also help mitigate the impact by preventing an attacker from sending a high volume of anonymous requests that trigger the deserialization logic Regularly updating UAA to versions where this caching and deserialization behavior has been hardened or removed is essential for maintaining service integrity and availability