CVE-2026-108062: CWE-400 in Eclipse Foundation Eclipse CSI - PIA

The vulnerability arises because the OIDC discovery and JWKS fetch operations are executed synchronously within the asyncio event loop before authentication. As a result, a single unauthenticated request can block the event loop, stalling the entire service and causing a denial-of-service (DoS) condition. This is categorized under CWE-400 (Uncontrolled Resource Consumption). The affected product is Eclipse CSI - PIA from the Eclipse Foundation, with versions from 0 up to and including 0.8.0 impacted. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No patch or remediation information is provided in the available data.

An attacker can cause a denial-of-service by sending a single unauthenticated request that stalls the asyncio event loop due to synchronous OIDC discovery and JWKS fetches. This results in the entire service becoming unresponsive until the blocking operation completes or times out. There is no indication of privilege escalation or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external protections such as rate limiting or isolating the affected service to mitigate the impact of potential denial-of-service attempts.