The vulnerability arises because OIDC discovery and JWKS fetches execute synchronously on the asyncio event loop before authentication. When an unauthenticated request triggers these operations, the entire service stalls, leading to a denial of service. The weakness is a lack of asynchronous handling and resource isolation, identified by CWE-400.

Eclipse Foundation Eclipse CSI – PIA. No specific version information is listed, so the issue applies to all releases that have not yet been patched.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting that while exploitation is possible, it may not be widespread yet. The likely attack vector consists of unauthenticated HTTP requests to the OIDC discovery or JWKS endpoints, which can be repeatedly sent to stall the service.