CVE-2026-78384

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-15

Assigner: Apache Software Foundation

Description

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78384

EUVD

EUVD-2026-95696

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache CXF 4.2.0
Apache	Software	Foundation Apache CXF 4.0.0
Apache	Software	Foundation Apache CXF 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This vulnerability involves the CompressionUtils.inflate() function decompressing attacker-controlled DEFLATE data without enforcing a maximum output size. A small payload of around 1KB could expand to gigabytes of data on the heap, potentially causing memory exhaustion.

Detection Guidance

Detect heap exhaustion from crafted DEFLATE data by monitoring memory usage spikes during JWE decryption or SAML token processing. Check for DataFormatException logs when org.apache.cxf.compression-max-inflated-size is exceeded.

Impact Analysis

This vulnerability can lead to denial-of-service attacks by consuming excessive memory, crashing applications, or enabling heap-based attacks. It is reachable through JWE decryption with zip=DEF or SAML token inflation before trust validation.

Compliance Impact

This vulnerability could lead to denial-of-service (DoS) attacks by exhausting heap memory, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13. Set org.apache.cxf.compression-max-inflated-size to a safe value (e.g., 10 MiB) to cap decompression size. Review JWE decryption and SAML token handling paths for untrusted input.

Hi! I’m here to help you understand CVE-2026-78384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70