CVE-2026-102695

Deferred Deferred - Pending Action

Memory Exhaustion in OmniFaces CombinedResourceHandler

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102695

EUVD

EUVD-2026-101293

Affected Vendors & Products

Vendor	Product	Version / Range
omnifaces	omnifaces	< 1.14.3
omnifaces	omnifaces	>= 2.0, < 2.7.33
omnifaces	omnifaces	>= 3.0, < 3.14.23
omnifaces	omnifaces	>= 4.0, < 4.7.12
omnifaces	omnifaces	>= 5.0, < 5.4.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability in OmniFaces before versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 involves the CombinedResourceHandler accepting forged combined resource IDs without verifying authenticity. Attackers can craft malicious IDs that cause unbounded memory usage through decompression amplification, permanently grow a cache with unique forged IDs, or disclose unintended resources like Facelets source files. The flaw bypasses security policies such as jakarta.faces.RESOURCE_EXCLUDES.

Detection Guidance

Check OmniFaces library versions in use. If running versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, or 5.4.2, the system is vulnerable. Inspect server logs for unusual resource requests or memory spikes during resource serving.

Impact Analysis

This vulnerability can lead to memory exhaustion from unbounded decompression, permanent cache growth from forged IDs, and disclosure of sensitive resources such as Facelets source files. It may also allow unauthorized resource combination in deployments with wildcard CDN mappings, though it does not enable arbitrary file read or full SSRF.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to resource disclosure and memory exhaustion risks. Unauthorized access to Facelets source files may expose sensitive application logic or data, while excessive memory consumption could disrupt system availability. The flaw bypasses security policies like jakarta.faces.RESOURCE_EXCLUDES, increasing the risk of data exposure.

Mitigation Strategies

Upgrade OmniFaces to a patched version (1.14.3, 2.7.33, 3.14.23, 4.7.12, or 5.4.2) to address the CombinedResourceHandler flaw.
Apply the security fix from the GitHub commit aa42da361821ddfbb85b126564e71587347d2786 if upgrading is not immediately possible.
Review server logs for unusual resource requests or memory spikes, which may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-102695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70