CVE-2026-108062

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

Score

CVSS 4.0 6.9 Medium

Status

Awaiting Analysis - emo@eclipse.org

Published

2026-10-20

Last modified

2026-10-20

Weaknesses

CWE-400

Affected products

• Eclipse Csi - Pia (Eclipse Foundation)

References

• https://github.com/eclipse-csi/pia/security/advisories/GHSA-jj77-2gc8-7pc6
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/400