CVE-2026-78384
Received Received - Intake

Heap Exhaustion via Unbounded DEFLATE in Apache CXF

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: Apache Software Foundation

Description
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-78384
EUVD
EUVD-2026-95696

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache CXF 4.2.0
Apache Software Foundation Apache CXF 4.0.0
Apache Software Foundation Apache CXF 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the CompressionUtils.inflate() function decompressing attacker-controlled DEFLATE data without enforcing a maximum output size. A small payload of around 1KB could expand to gigabytes of data on the heap, potentially causing memory exhaustion.

Detection Guidance

Detect heap exhaustion from crafted DEFLATE data by monitoring memory usage spikes during JWE decryption or SAML token processing. Check for DataFormatException logs when org.apache.cxf.compression-max-inflated-size is exceeded.

Impact Analysis

This vulnerability can lead to denial-of-service attacks by consuming excessive memory, crashing applications, or enabling heap-based attacks. It is reachable through JWE decryption with zip=DEF or SAML token inflation before trust validation.

Mitigation Strategies

Upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13. Set org.apache.cxf.compression-max-inflated-size to a safe value (e.g., 10 MiB) to cap decompression size. Review JWE decryption and SAML token handling paths for untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78384. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart