OmniFaces: Forged combined resource IDs enable memory exhaustion and disclosure
Summary
OmniFaces, a utility library for Jakarta Faces, accepts combined resource IDs without verifying that the server issued them. A remote attacker without privileges can send forged IDs to cause unbounded decompression and memory exhaustion, add permanent entries to a server-side cache, and disclose Facelets source files from the resource tree. If the wildcard CDN mapping is configured, a crafted ID can also trigger a limited, blind server-side fetch. According to the CVE record, arbitrary file read and arbitrary SSRF are not possible.
Affected
- Versions before 1.14.3
- Versions 2.0 to before 2.7.33
- Versions 3.0 to before 3.14.23
- Versions 4.0 to before 4.7.12
- Versions 5.0 to before 5.4.2
Fixed in
- 1.14.3
- 2.7.33
- 3.14.23
- 4.7.12
- 5.4.2
Workaround
- Unknown. No vendor-issued workaround has been identified. Upgrading to a fixed version is the remedy.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV.
- No public proof of concept confirmed in the sources reviewed.
Our recommendation
- Upgrade OmniFaces to the fixed version for your release line.
- Do not rely on the earlier fix for CVE-2026-41883; the forged-ID behavior is addressed only by the fixed versions above.
- Identify internet-facing Jakarta Faces applications that use OmniFaces and prioritise them.
- If the wildcard CDN mapping is used, review its configuration.
- Monitor memory usage and requests to the resource handler for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fp43-vj7g-pg92 github.com
- OmniFaces fix commit aa42da3 github.com
- OmniFaces release 1.14.3 github.com
- OmniFaces release 2.7.33 github.com
- OmniFaces release 3.14.23 github.com
- OmniFaces release 4.7.12 github.com
- OmniFaces release 5.4.2 github.com
- OSV entry CVE-2026-102695 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:25.
Original description (NVD)
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.
NVD references (7)
- https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786
- https://github.com/omnifaces/omnifaces/releases/tag/1.14.3
- https://github.com/omnifaces/omnifaces/releases/tag/2.7.33
- https://github.com/omnifaces/omnifaces/releases/tag/3.14.23
- https://github.com/omnifaces/omnifaces/releases/tag/4.7.12
- https://github.com/omnifaces/omnifaces/releases/tag/5.4.2
- https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.