CVE-2026-78384

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13

Description The CompressionUtils.inflate() function decompresses attacker-controlled DEFLATE data without an output-size cap, allowing a small crafted payload to expand to gigabytes on the heap, leading to a decompression bomb. This is reachable during JWE decryption when zip=DEF (for example, via JoseSessionTokenProvider with RSA-OAEP key wrap) and through SAML redirect or POST binding token inflation, as decompression occurs before trust validation.

Recommendations Upgrade to version 4.2.4. Upgrade to version 4.1.9. Upgrade to version 3.6.13. Configure the org.apache.cxf.compression-max-inflated-size system property to set a maximum inflated-size cap.