CVE-2026-40942: 
Java vulnerability analysis and mitigation

CVE-2026-40942 is an inverted time comparison vulnerability in the Data Sharing Framework (DSF), a distributed process engine implementing BPMN 2.0 and FHIR R4 standards. The flaw affects the OIDC JWKS/Metadata Document caches and the OIDC token cache in versions prior to 2.1.0 of dev.dsf:dsf-bpe-server and dev.dsf:dsf-bpe-process-api-v2. It was published on April 21, 2026, and fixed in DSF version 2.1.0. The vulnerability carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is an always-incorrect control flow implementation (CWE-670): the cache expiry checks in BaseOidcClientWithCache and OidcClientWithCache used isBefore instead of isAfter when comparing the cache timeout against the current time. This produced two distinct behavioral defects: (1) the OIDC JWKS and Metadata Document caches never returned cached values — every request triggered a fresh HTTP fetch from the OIDC provider; and (2) the OIDC access token cache never invalidated — every request returned the same (potentially expired) token. The fix, applied in commits 31c2e97 and d3ca59b, corrects the comparison operator from isBefore to isAfter in both BaseOidcClientWithCache.getOrSet() and OidcClientWithCache.getConfiguration()/getJwks()/getAccessTokenDecoded() methods, and adds configurable cache timeouts (GitHub Commit 31c2e97, GitHub Commit d3ca59b).

The vulnerability has two distinct availability impacts: excessive network load on the OIDC provider due to uncached JWKS/metadata fetches on every request, and the continued use of expired OIDC tokens for FHIR client connections, which can only be cleared by restarting the BPE server. If the OIDC provider becomes temporarily unreachable, all OIDC-authenticated requests fail immediately rather than falling back to cached keys, causing a denial-of-service condition for DSF FHIR Server and BPE Server deployments with bearer-token authentication or back-channel logout enabled. There is no confidentiality or integrity impact; the primary risk is degraded availability and potential rate-limiting of the OIDC provider (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific attack prerequisites (the OIDC provider must be reachable or deliberately made unreachable), limiting practical exploitability (GitHub Advisory).

Upgrade to DSF version 2.1.0, which corrects the inverted cache timeout comparisons in both BaseOidcClientWithCache and OidcClientWithCache. The fix also introduces two new configurable cache timeout properties: dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource and dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource (both defaulting to PT1H). No workaround is available for the token cache issue short of upgrading; for the JWKS/metadata cache issue, restarting the BPE server can temporarily clear the stale token cache (GitHub Advisory, GitHub Commit 31c2e97).