CVE-2017-4960: Cloudfoundry Cloud Foundry Uaa Bosh

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.

Affected products

• Cloudfoundry Cloud Foundry Uaa Bosh: version 21 only; version 22 only; version 23 only; version 24 only; version 24.1 only; version 24.2 only; …
• Pivotal Software Cloud Foundry: version 247.0 only; version 248.0 only; version 249.0 only; version 250.0 only; version 251.0 only; version 252.0 only
• Pivotal Software Cloud Foundry Uaa: version 3.9.0 only; version 3.9.1 only; version 3.9.2 only; version 3.9.3 only; version 3.9.4 only; version 3.9.5 only; …

Published 2017-03-10. Last modified 2026-06-17.