A DoS vulnerability exists in Cloud Foundry UAA’s private_key_jwt client‑authentication path. When UAA retrieves a JWKS document from a remote URI it stores the response in a cache. Subsequent authentication attempts trigger full deserialization of this cached data. If an attacker can influence the JWKS content—by writing client configuration or compromising an endpoint—it can cause repeated parsing of large, complex objects. The resulting CPU exhaustion and OutOfMemoryError can deplete the Java heap and render the UAA service unavailable to legitimate users.

Cloud Foundry UAA and cf‑deployment are affected. No specific impacted versions are listed; the vulnerability applies to any deployment using the insecure JWKS URI handling mechanism described.

The CVSS score is 6.9, indicating a moderate impact. EPSS score is not available and the issue is not in the CISA KEV catalog. The attack vector is inferred to be remote, requiring the attacker to send crafted anonymous requests to the UAA instance. Successful exploitation would lead to service unavailability due to excessive resource consumption and potential heap exhaustion.