CVE-2026-102695 Details
Description
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.
A vulnerability exists in OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, within the CombinedResourceHandler component. The issue arises because the handler accepts combined resource IDs that are structurally valid but not authenticated, allowing attackers to craft IDs that can be exploited. This can lead to unbounded output from decoded data, excessive growth of the process-lifetime cache, and the ability to combine resources beyond just stylesheets and scripts. Notably, this vulnerability can be exploited to access Facelets source files from the web application resource tree or META-INF/resources, depending on the crafted ID. In certain deployments with wildcard CDN mapping, the vulnerability can also trigger a blind server-side fetch based on the request's Host header, although this does not constitute arbitrary file read or SSRF.
Users can upgrade to OmniFaces versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, or 5.4.2 to address this vulnerability. Instructions for downloading these versions are available on the OmniFaces GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786 | [email protected] | Source CodeVendor |
| https://github.com/omnifaces/omnifaces/releases/tag/1.14.3 | [email protected] | Release NotesVendor |
| https://github.com/omnifaces/omnifaces/releases/tag/2.7.33 | [email protected] | Release NotesVendor |
| https://github.com/omnifaces/omnifaces/releases/tag/3.14.23 | [email protected] | Release NotesVendor |
| https://github.com/omnifaces/omnifaces/releases/tag/4.7.12 | [email protected] | Release NotesVendor |
| https://github.com/omnifaces/omnifaces/releases/tag/5.4.2 | [email protected] | Release NotesVendor |
| https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OmniFaces | < 1.14.3 (semver) >= 2.0, < 2.7.33 >= 3.0, < 3.14.23 >= 4.0, < 4.7.12 >= 5.0, < 5.4.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |